{"report_id":"ca491ec7-17f4-4546-bb92-0affba24e1f7","version":0,"status":"done","tags":[],"date":"2026-09-19T15:09:01Z","url":{"schema":"http","addr":"helvar-goldenorbit.click/","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"areduquiz.site/TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b","fqdn":"areduquiz.site","domain":"areduquiz.site","tld":"site"},"title":"Market Potential Explorer","dom":{"size":31949,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"d74a5e1b3c6a4186d41f2dd868e40bd0","sha1":"47cd8fcc9c5e067cf7d049b3c27c80f152124952","sha256":"3ec4e19ba73ec4f6ad623771ebf3bad3ed39bab2494b4ef9cee40633b455e980","sha512":"26a15b8f0b60d201d449acf06a23ab130b374aa5115e522332df86bed98a2944b2d506b8dfe2ddc9c3ba5d063cec16ed125ceda2815e4ab6beb6af5919c826b0","ssdeep":"384:uTdMg0IgBn6SivY9IjWJy4UpJZQpHZVGmBziaDYYtqEL9bGmqJ2mu:20IgB6SivY9IiY4UXa9ZVGczbkJy","tlshash":"1de2c6692ab30031b91395b977e717897b74e0078907d4283ecd53448fcabd9e9a379c","dom_hash":"domhash67c0b7cbbf48653f51e40af2abe68ee7","first_seen":"2026-09-19T15:09:12.002534Z","last_seen":"2026-09-19T15:09:12.002534Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"helvar-goldenorbit.click/","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T15:09:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"helvar-goldenorbit.click","ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-19T14:51:00.258874Z","last_seen":"2026-09-19T14:51:00.258874Z","alert_count":68,"request_count":17,"received_data":44677,"sent_data":11835,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"areduquiz.site","ip":{"addr":"104.21.14.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-08-05","domain_rank":0,"first_seen":"2026-09-19T14:51:00.259354Z","last_seen":"2026-09-19T14:51:00.259354Z","alert_count":0,"request_count":2,"received_data":33809,"sent_data":1270,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/firebase.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d98281d698bb41c345b22f6ebc8cfb82","sha1":"93b35449674e3c9ab25f521d1f1772cca691c986","sha256":"8223c96cc886c6a876f82d600ff44832a24d4afc5124c9ca0be7b2a3f31ebae6","sha512":"1df38932dfdea6998a0622403a571bd986dcde98e2ad7d3c439bee5137c7283a3890cd394e310331de0949696a56c1d81a78a607fddc121de9f2ca01883e8ab1","ssdeep":"192:UQtNErNeEqn+SrmHaLt6FXohdyASPj7PjNPrt6/feScbMLTMj1ub3lDVMKFMHMO0:w+Lthf5Sn12ZS1uDlhBqNFk1","tlshash":"6092524f19fbb4335663b0bbaf5f6051253a60031648be54bbae43a02f8207d5ab77d4","size":19560,"data":"","first_seen":"2026-07-28T16:49:01.114581Z","last_seen":"2026-09-19T15:09:12.004448Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/resolveOfferUrl.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7bae3aceeb92b3c58cb59fc4e2debe77","sha1":"8fe994f4889bec9ce01b8d6d094494ec52796eb9","sha256":"9f68bc182a49ac9c8466e3994ff78534e0605ed4961cc839b9493923f518d270","sha512":"c7f6605a1c1b6ec63afa74c0d856b8afedf53f2bea17275e3b5e94bf63893bb033912bb559d26c8ca910fe782d48f46024c4289e2b8e08327c4d95b61e0c974a","ssdeep":"","tlshash":"4561834619fa20e70242f09aeb47744d7a6751fb37b68711352d3ea2bfe21306228f05","size":3286,"data":"","first_seen":"2026-09-19T15:09:12.007662Z","last_seen":"2026-09-19T15:09:12.007662Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/sentEvents.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7b4cee510984a654632af16e6eea3e35","sha1":"67d3a1ceb81dd464942950cf8a1c2b65dab28dd2","sha256":"e3fbc74caea36d5c293fb8935ae1a06b36a41777cdc38174b33f507abf7a3c07","sha512":"db6a7f1096aad93ab636f6a665fbbf9be1a21f1dd983b5b7195267e743620d20cd1e8a5e64ea3f65abca3caf98894451b25eea26f0afbc1f443212c08ba1584c","ssdeep":"","tlshash":"04217bcf58f715a7477bb0be035b68077122481bba9ac9a5fa0d0a446f4027c46b1ed9","size":1182,"data":"","first_seen":"2026-09-19T15:09:12.022726Z","last_seen":"2026-09-19T15:09:12.022726Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/getSafeDate.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8701eae7ebe3667f4fbf2fb6301051a6","sha1":"e50d44534b75efe129ac89ad2cec497aef2b87cb","sha256":"f86090e864d2898bd6faa6056552735513677a010e666aec982fb28e8b0817d2","sha512":"381aa5901928bebf85166327cc97ff893c959084fb0594ed706df20f75cba66ffb6991bc6d77b0a504278314301f5f2003377389ee52a28d574905785641111a","ssdeep":"","tlshash":"a0c08c0c22bcb30402023b7c02470684ba48a4232fcc8cf9b60db3801f92030c0ba2ca","size":158,"data":"","first_seen":"2026-07-28T16:49:01.018799Z","last_seen":"2026-09-19T15:09:12.035865Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/performedRedirect.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3a9147d2fd783e2a0e0d6efca4804295","sha1":"e74d3b28c31d2df5912a1aea57b629c2f9ad90e2","sha256":"6d4a2f63a4181bfd042201539360d0f5a9baf23d6f935edf280e0d0164cd668e","sha512":"e71333daa35cc8d60f3e4eb5a8a54b6f9928a78577b7ea60333b0c23442099d24494c02a487d7ad161f707b1fcaeccd5f0614b32919282de49450764a1c4576a","ssdeep":"","tlshash":"7e01280a10835621ed93f37ecfdb202953360d5b28080e147a1c4a58ff9123e265fb9e","size":760,"data":"","first_seen":"2026-07-28T16:49:01.162037Z","last_seen":"2026-09-19T15:09:12.026072Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/maping.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9df5224d7bca4d35e33ce7bcad98da2b","sha1":"3d4db727efea94902ab3d7cd5be23b7ef18136ec","sha256":"0bb52f36928d61fb08cdd60ed56b594d337b1d6ee131bb11a917816130616995","sha512":"18c3bbb00047386528cbf9e6b9574b9bb573f9a9a63fcaa648f8324cf8afcb14fe9d7e372c9f7112ed88afa902de59b00a37c7cc9c2e6fe4578284b0e0b1a9fc","ssdeep":"","tlshash":"83d012b67de3e000c2467119465ec576a0042cb705280e9975bed6f46f19e6448563e1","size":220,"data":"","first_seen":"2025-09-19T07:51:01.391247Z","last_seen":"2026-09-19T15:09:12.021286Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/firebase-prewarm.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"98f6624f3b06d19e150a3ba54c6aea64","sha1":"5d048957e7d4d912a918520e5f266481007283d6","sha256":"56d236c1f22ec636017694031d58e458d3a53ce2ba4c06c76626c5189220094b","sha512":"0937f3065b315946f17a02d30991c7f62e637badc12fa26a6e7a68aec12d97c8fdd91d4effa092bc41145df86c8b8f14ac8c4560c1ebdc8cd2e6efcdcdea69ae","ssdeep":"","tlshash":"4f51fd4a599bb06b4f2370beca4f6105f5bb000b4d0ecb05795eaa615fb267403b2acd","size":2474,"data":"","first_seen":"2026-07-25T05:49:00.120428Z","last_seen":"2026-09-19T19:19:18.755999Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/main.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dbe73908d1b03a2144d42f826bba6be7","sha1":"715feb9b69e54be2067b081451715025d1df9e85","sha256":"14f7d2faae9bb8589319fd7c7b7e11770babf8ea2ffd8668ad78e7f658375919","sha512":"cadf2bd0c95a6aaa9937792d918fd454144ef6eb3b44a921a025848a1eedf99b82c24849c4a67cabdab964899d0accefda45b7370729557f675eaca590e5ec29","ssdeep":"192:FzcOzRpcRwcwjsIl1Uzjk2EWH+fPk51f/1jn:SqaRDPksSU","tlshash":"ace1940f03ab6977045070f9668e251ab636a03b320d9b29330d5f75bf8359dd2b638e","size":7211,"data":"","first_seen":"2026-09-19T15:09:12.024059Z","last_seen":"2026-09-19T15:09:12.024059Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/decodeLeadInfo.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"16b4a59ff4a670018c9863107c0c8e47","sha1":"459f7dfd79b96051417b7417305c3ef52c7d8949","sha256":"0b2253a912db0db2b3121ffa1f5f1921ddae9e21432ef6151ae3cf2541ca5e52","sha512":"34e4a03038bdd769ade7da8db14305ddb238bc59010d560bffa73a516c86cc12b9fac1ec5616cd8e3a401b8bdc03c9c32977ebd1555a377276a7921259b6427b","ssdeep":"","tlshash":"87218741eea7804320ebb09c4387508aa278541bbe24bd08781d5b44ffd0d2c55e36e3","size":1214,"data":"","first_seen":"2026-07-28T16:49:01.109278Z","last_seen":"2026-09-19T15:09:12.006237Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"areduquiz.site/TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b","fqdn":"areduquiz.site","domain":"areduquiz.site","tld":"site"},"ip":{"addr":"104.21.14.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"96dffb390f85f2844a0236d9f6fa3314","sha1":"5803de9282abbf3e9b774c84fdb1ae34fc5b1bd9","sha256":"14c5ebc823a3f6525899ba74771c072fa946ff0af88186da02166dacdbcf3cb6","sha512":"22fb45d0301c03f6f69d5ea01b576dc13a5e03d0b8a159c50a38506a710e8f21f90cf03c037c12024a67b5681b7213c7095817cf86611590ec70c5605fe7de5f","ssdeep":"192:Q0g0A6BSodfdZV1Jm1k1dNWeBG2iYr/hPDYYIfRP0qjIL9bGmRLGsaLJSRmjz:aZQpHZVGmBziaDYYtqEL9bGmqJ2mX","tlshash":"df2264a639b380305b87567aa7d72284fa3498033946f4643e4dc3104f96f5b66b6bfc","size":10711,"data":"","first_seen":"2026-09-19T14:51:04.331695Z","last_seen":"2026-09-19T19:19:18.756752Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/firebase.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.840Z","timestamp":1789830513840,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/firebase.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8P1V4PX0P8QNKdpxWqG3eKy2aTVq2%2F4qOgeSrbc48JWQjvzYInvMVaQ7EU3exUZhMoICX1Wajl1fquAPxgJjCrVA%2B%2F8lEMPJ3likpO279BLfpsjGnQ2qTmnusvABO15eJxLUE%2B8YhCrGDFY%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a78889b500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-4c68\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19560,"size_decoded":5506,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d98281d698bb41c345b22f6ebc8cfb82","sha1":"93b35449674e3c9ab25f521d1f1772cca691c986","sha256":"8223c96cc886c6a876f82d600ff44832a24d4afc5124c9ca0be7b2a3f31ebae6","sha512":"1df38932dfdea6998a0622403a571bd986dcde98e2ad7d3c439bee5137c7283a3890cd394e310331de0949696a56c1d81a78a607fddc121de9f2ca01883e8ab1","ssdeep":"192:UQtNErNeEqn+SrmHaLt6FXohdyASPj7PjNPrt6/feScbMLTMj1ub3lDVMKFMHMO0:w+Lthf5Sn12ZS1uDlhBqNFk1","tlshash":"6092524f19fbb4335663b0bbaf5f6051253a60031648be54bbae43a02f8207d5ab77d4","first_seen":"2026-07-28T16:49:01.114581Z","last_seen":"2026-09-19T15:09:12.004448Z","times_seen":3,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/decodeLeadInfo.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.842Z","timestamp":1789830513842,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/decodeLeadInfo.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OHxSn%2BhcNUXy8ZdEhD3XGejWiO%2FWD4UtpuHI%2BpOgP47Rb64BuZWwFDIIgmupx%2FYzCm7TfVLu%2B1caDZmTywgwEfDKTwPoC%2Fsgwa7ml7I0sXrUhUyfuIx9MuyY8NBlBlGCanhSLugGhREnzv0%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a7888ab500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-4be\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1214,"size_decoded":1224,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"16b4a59ff4a670018c9863107c0c8e47","sha1":"459f7dfd79b96051417b7417305c3ef52c7d8949","sha256":"0b2253a912db0db2b3121ffa1f5f1921ddae9e21432ef6151ae3cf2541ca5e52","sha512":"34e4a03038bdd769ade7da8db14305ddb238bc59010d560bffa73a516c86cc12b9fac1ec5616cd8e3a401b8bdc03c9c32977ebd1555a377276a7921259b6427b","ssdeep":"","tlshash":"87218741eea7804320ebb09c4387508aa278541bbe24bd08781d5b44ffd0d2c55e36e3","first_seen":"2026-07-28T16:49:01.109278Z","last_seen":"2026-09-19T15:09:12.006237Z","times_seen":3,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/resolveOfferUrl.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.844Z","timestamp":1789830513844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/resolveOfferUrl.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XeJ1I1v36KvD4SUvEm0IrUbQlhbm7hyBG67OZ05mVc5jGpZTv6fUJ30HzfiewqiD0MYJHAxGn7K9tDIM66hb%2FzB%2BlVLc%2FBfg8xO8TWeQo7hLEqFNCgO35pNeZ50nLN%2FrbnZDz8MeA6mtauo%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a7888bb500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-cd6\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3286,"size_decoded":2399,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"7bae3aceeb92b3c58cb59fc4e2debe77","sha1":"8fe994f4889bec9ce01b8d6d094494ec52796eb9","sha256":"9f68bc182a49ac9c8466e3994ff78534e0605ed4961cc839b9493923f518d270","sha512":"c7f6605a1c1b6ec63afa74c0d856b8afedf53f2bea17275e3b5e94bf63893bb033912bb559d26c8ca910fe782d48f46024c4289e2b8e08327c4d95b61e0c974a","ssdeep":"","tlshash":"4561834619fa20e70242f09aeb47744d7a6751fb37b68711352d3ea2bfe21306228f05","first_seen":"2026-09-19T15:09:12.007662Z","last_seen":"2026-09-19T15:09:12.007662Z","times_seen":1,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/api/leads/link/offer/resolve?lead_uuid=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.957Z","timestamp":1789830513957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /api/leads/link/offer/resolve?lead_uuid=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 19 Sep 2026 15:08:34 GMT\r\ncontent-type: application/json\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a83899b500-OSL\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NEpnoAdLOC4DZB7%2FGuOaQg3%2FhfxXJ3LwnmwnMtROk5u7XgrOUdvJidw4mfobPd3xfMWtmqvBnTTrNLnAGKA9WLP3S%2Fc3r3ZRjMFJ4t1XVyXOsYABm31NF7y%2FTcCh6g0VJBtkvVlPUPjlSnM%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":149,"size_decoded":730,"mime_type":"application/json","magic":"JSON text data","md5":"7c417aaf41bd81147dad8ef7233ea050","sha1":"00732b91e481e892aa48ccf48918c5fc93dd54fa","sha256":"e4bdab84c06d74b67f121d3a60a03466eed7bcdac4b50a0a5c1a9524232aa7de","sha512":"2a2985aae7b648b123cf8afd285c59b084a2f0f7786b9a5be8252922027cff4c4e639772baf9a34c38a1f6ca04384f9c457008c70bb537eab6a25be3427a4cfa","ssdeep":"","tlshash":"55c08c6b31026a734280328912493b48212c040bc8c03e4ac038c5c4cc7a089a8c2a17","first_seen":"2026-09-19T15:09:12.018003Z","last_seen":"2026-09-19T15:09:12.018003Z","times_seen":1,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T15:08:32.619Z","timestamp":1789830512619,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\ndate: Sat, 19 Sep 2026 15:08:32 GMT\r\nserver-timing: cfExtPri\r\nlocation: https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=\r\nserver: cloudflare\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ydFMgycIaCrhFoVe4GocD2eHaIS1vS8yUEijzeYaLgSpQvxciNs3W%2FI%2FbRtEPePBrH5c%2FE0y47MAZvcGB0YZRTnBOeEWiAipEh6m06QhNfsYve%2BC1K7As3SJltvm7rtErjXyQQJALXGoWtI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\ncf-ray: a3d981a02fecb500-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":24,"connect":18,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T15:08:32.822Z","timestamp":1789830512822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid= HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a12801b500-OSL\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nset-cookie: cl_st=b; expires=Sun, 20 Sep 2026 15:08:33 GMT; Max-Age=86400; path=/\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Of4etN45TGPJACIkXjFouRqC3WkuRUW%2BaK56KhGSccR29iORioKS8Nf2Rnmg5ko0UJCmBnOw%2BRCPOVr7Yw5pzzDmsKFgOFbNKTQ0MUKq%2F4SQbcTMEA%2FfDlbOsW7X9jljM%2FhxuZSyhvvjl08%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"cl_st","value":"b","quoted":false,"path":"/","expires":"2026-09-20T15:08:33Z","raw_expires":"Sun, 20 Sep 2026 15:08:33 GMT","max_age":86400,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"cl_st=b; expires=Sun, 20 Sep 2026 15:08:33 GMT; Max-Age=86400; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1162,"size_decoded":1402,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"1425487d5b37330f6c6afcf78a13e549","sha1":"68363b2bc534cffefa630be8320f59433f816c1c","sha256":"f63a140faef0e98c7ee5608b77ec0ca37f12a13c4fd0ea1dbbd13e0b170efbf4","sha512":"b2616b056b1118078de5d04b995fc8c63602c2762845587e4fa861a54fa4593fe986a9151575f698a37b33f3974b9903fe951163e4cefe2bc2385d399b747ead","ssdeep":"","tlshash":"2b21035a1ca2e0da23b05d7995e7f11c7af90b103541c8147cedc0142e69e9f8cd7d8d","first_seen":"2026-06-28T13:35:41.221324Z","last_seen":"2026-09-19T19:19:18.752739Z","times_seen":12,"resource_available":true,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/app.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=","date":"2026-09-19T15:08:33.365Z","timestamp":1789830513365,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"GET /2a259d6f-16c0-4e53-8cab-de36eb7005a0/app.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/maping.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.836Z","timestamp":1789830513836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/maping.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W09mv13UstmgPKqjVDMThAeWRJBDwvJJNizrDQlgHmi4RLdiKBL9YhE5UWy7004dGuQEcVQWLnkSRgYttPKWqAuZ54GHh3LxgJjHwCgV7M9QYyvSC1aZ2aVlj%2BdRXx5PN8od%2F1FeM7SsGwY%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a77887b500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-dc\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":220,"size_decoded":831,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"9df5224d7bca4d35e33ce7bcad98da2b","sha1":"3d4db727efea94902ab3d7cd5be23b7ef18136ec","sha256":"0bb52f36928d61fb08cdd60ed56b594d337b1d6ee131bb11a917816130616995","sha512":"18c3bbb00047386528cbf9e6b9574b9bb573f9a9a63fcaa648f8324cf8afcb14fe9d7e372c9f7112ed88afa902de59b00a37c7cc9c2e6fe4578284b0e0b1a9fc","ssdeep":"","tlshash":"83d012b67de3e000c2467119465ec576a0042cb705280e9975bed6f46f19e6448563e1","first_seen":"2025-09-19T07:51:01.391247Z","last_seen":"2026-09-19T15:09:12.021286Z","times_seen":4,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/sentEvents.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.897Z","timestamp":1789830513897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/sentEvents.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/performedRedirect.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LehZQv5gpOxzOrxjIg4HuWqi%2FATPmu0liy6HaMAbukiG7pDZSbNtlLhMT0BWgVP%2FCz%2FF7RMsKT9dvwTwJNdAt%2BcpTSeUnXNeUDH6Ky4neLyF41VTru6X10PID4a3ctThzSbeo24LmSY4fYI%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a7e892b500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-49e\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1182,"size_decoded":1249,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"7b4cee510984a654632af16e6eea3e35","sha1":"67d3a1ceb81dd464942950cf8a1c2b65dab28dd2","sha256":"e3fbc74caea36d5c293fb8935ae1a06b36a41777cdc38174b33f507abf7a3c07","sha512":"db6a7f1096aad93ab636f6a665fbbf9be1a21f1dd983b5b7195267e743620d20cd1e8a5e64ea3f65abca3caf98894451b25eea26f0afbc1f443212c08ba1584c","ssdeep":"","tlshash":"04217bcf58f715a7477bb0be035b68077122481bba9ac9a5fa0d0a446f4027c46b1ed9","first_seen":"2026-09-19T15:09:12.022726Z","last_seen":"2026-09-19T15:09:12.022726Z","times_seen":1,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/favicon.ico","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:34.056Z","timestamp":1789830514056,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/api/leads/link/aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b/event","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:34.123Z","timestamp":1789830514123,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"POST /api/leads/link/aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b/event HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\r\nContent-Type: application/json\r\nContent-Length: 162\r\nOrigin: https://helvar-goldenorbit.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":162,"data":"{\"events\":[{\"name\":\"push_skipped\",\"datetime\":\"2026-09-19T15:08:33.971Z\",\"push_fcm_token\":null},{\"name\":\"first_offer_open\",\"datetime\":\"2026-09-19T15:08:34.122Z\"}]}"}},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/main.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.752Z","timestamp":1789830513752,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/main.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WoHU6pEuhqsrXd8q3ZS95wgvQ8M3nueETm2VrjAQ5SjcUAmbbhcxCMNNF1PTVCgi%2FZF0iMVplnKEJZKd%2Br4pGyiKKjsRCmgDpAwXBI984IKaPCuPiBcNkWqT7ofCst4Z5GgdvsjctNPdyug%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a6f87bb500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-1c2b\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7211,"size_decoded":3548,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"dbe73908d1b03a2144d42f826bba6be7","sha1":"715feb9b69e54be2067b081451715025d1df9e85","sha256":"14f7d2faae9bb8589319fd7c7b7e11770babf8ea2ffd8668ad78e7f658375919","sha512":"cadf2bd0c95a6aaa9937792d918fd454144ef6eb3b44a921a025848a1eedf99b82c24849c4a67cabdab964899d0accefda45b7370729557f675eaca590e5ec29","ssdeep":"192:FzcOzRpcRwcwjsIl1Uzjk2EWH+fPk51f/1jn:SqaRDPksSU","tlshash":"ace1940f03ab6977045070f9668e251ab636a03b320d9b29330d5f75bf8359dd2b638e","first_seen":"2026-09-19T15:09:12.024059Z","last_seen":"2026-09-19T15:09:12.024059Z","times_seen":1,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/performedRedirect.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.839Z","timestamp":1789830513839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/performedRedirect.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2U9ROXBY82MrbFTnyRY3U4ep35FWxwwbvHh6L%2Fpaem03GzpIqda5aS8qVKV%2BRPwR3u6SNZKTy9C8gWctX7CsKoZCfk7w3PcL%2BCT3tQnRFvCju8OzRFu62DKfQkVPh65gyxhbGwZpd2mVQl8%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a78888b500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-2f8\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":760,"size_decoded":1078,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"3a9147d2fd783e2a0e0d6efca4804295","sha1":"e74d3b28c31d2df5912a1aea57b629c2f9ad90e2","sha256":"6d4a2f63a4181bfd042201539360d0f5a9baf23d6f935edf280e0d0164cd668e","sha512":"e71333daa35cc8d60f3e4eb5a8a54b6f9928a78577b7ea60333b0c23442099d24494c02a487d7ad161f707b1fcaeccd5f0614b32919282de49450764a1c4576a","ssdeep":"","tlshash":"7e01280a10835621ed93f37ecfdb202953360d5b28080e147a1c4a58ff9123e265fb9e","first_seen":"2026-07-28T16:49:01.162037Z","last_seen":"2026-09-19T15:09:12.026072Z","times_seen":3,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"areduquiz.site/TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b","fqdn":"areduquiz.site","domain":"areduquiz.site","tld":"site"},"ip":{"addr":"104.21.14.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T15:08:34.282Z","timestamp":1789830514282,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"areduquiz.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 06:12:26 GMT","end":"Sun, 08 Nov 2026 07:11:02 GMT"},"fingerprint":{"sha1":"20:DC:B0:B6:2A:19:ED:1B:28:A2:56:5B:7E:27:97:69:57:81:5A:14","sha256":"C0:07:7C:95:36:11:98:86:26:DF:86:46:C8:8E:E2:19:FD:F9:0A:DE:CC:03:D2:47:36:7E:50:AE:CF:3D:2D:C3"}}},"request":{"raw":"GET /TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b HTTP/1.1\r\nHost: areduquiz.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 19 Sep 2026 15:08:40 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncache-control: no-cache, no-store, must-revalidate\r\nexpires: Sat, 19 Sep 2026 15:08:40 GMT\r\nset-cookie: e3b0c4_56=3stn1bn3ebdb8v; expires=Wed, 18 Aug 2027 22:50:32 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none\n_token=3stn1bn3ebdb8v.1789916920.3.2a613f08e177c91dc5daac4464d33f4b; expires=Sun, 20 Sep 2026 15:08:40 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none\n_subid=18uumd0.38.6oqe; expires=Wed, 18 Aug 2027 22:50:32 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none\r\naccess-control-allow-origin: *\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y%2By16M426xAbNcVp47b9THIEhBPzvpSPa0TL9bjG7ZTJzvtk6Z0MAdHnPcjGzEuaNRpjUGduENA7dKVJxOixDK3CMEiVReu0nTcd8UEQftVeHfFE3OSF3pzpB%2BRKtUq%2F%2FQ%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a3d981d27dff56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"e3b0c4_56","value":"3stn1bn3ebdb8v","quoted":false,"path":"/","domain":"areduquiz.site","expires":"2027-08-18T22:50:32Z","raw_expires":"Wed, 18 Aug 2027 22:50:32 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"e3b0c4_56=3stn1bn3ebdb8v; expires=Wed, 18 Aug 2027 22:50:32 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none"},{"name":"_token","value":"3stn1bn3ebdb8v.1789916920.3.2a613f08e177c91dc5daac4464d33f4b","quoted":false,"path":"/","domain":"areduquiz.site","expires":"2026-09-20T15:08:40Z","raw_expires":"Sun, 20 Sep 2026 15:08:40 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"_token=3stn1bn3ebdb8v.1789916920.3.2a613f08e177c91dc5daac4464d33f4b; expires=Sun, 20 Sep 2026 15:08:40 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none"},{"name":"_subid","value":"18uumd0.38.6oqe","quoted":false,"path":"/","domain":"areduquiz.site","expires":"2027-08-18T22:50:32Z","raw_expires":"Wed, 18 Aug 2027 22:50:32 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"_subid=18uumd0.38.6oqe; expires=Wed, 18 Aug 2027 22:50:32 GMT; path=/; domain=areduquiz.site; secure; httponly; samesite=none"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31934,"size_decoded":10150,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"d4d65ecd33ed17f11d85b153b6a03a82","sha1":"1fe4d4d6b4ebbd7340edaa03724e7023e264a027","sha256":"6601a1f269b5921259593a6842ead0783d3e530ee13308d5a014725adf67137f","sha512":"c808b41f817b9965a782bca54f33ee94668f326a7d9b820ea27a0a3e0c0e909075f5c3d5ef8a236f28c1801ad8418bc50b489f36bcacb88be1c39d6a3a30dd08","ssdeep":"384:8TdMg0IgBn6SivY9VjWJ84UUJZQpHZVGmBziaDYYtqEL9bGmqJ2ms:g0IgB6SivY9Viq4U0a9ZVGczbkJA","tlshash":"fee2d6692ab30031b91395b977e717897b34e0038907d4283edd53448fcabd9e9a3b9c","first_seen":"2026-09-19T15:09:12.027745Z","last_seen":"2026-09-19T15:09:12.027745Z","times_seen":1,"resource_available":true,"data":null}},"time_used":6608,"timings":{"blocked":-1,"dns":21,"connect":1,"send":0,"wait":175,"receive":0,"ssl":6410},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"areduquiz.site/favicon.ico","fqdn":"areduquiz.site","domain":"areduquiz.site","tld":"site"},"ip":{"addr":"104.21.14.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://areduquiz.site/TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b","date":"2026-09-19T15:08:41.032Z","timestamp":1789830521032,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"areduquiz.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 06:12:26 GMT","end":"Sun, 08 Nov 2026 07:11:02 GMT"},"fingerprint":{"sha1":"20:DC:B0:B6:2A:19:ED:1B:28:A2:56:5B:7E:27:97:69:57:81:5A:14","sha256":"C0:07:7C:95:36:11:98:86:26:DF:86:46:C8:8E:E2:19:FD:F9:0A:DE:CC:03:D2:47:36:7E:50:AE:CF:3D:2D:C3"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: areduquiz.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://areduquiz.site/TVRfFzD7?lead_id=aec6e78e-80f5-40c1-b6cb-3eb0b4968e6b\r\nCookie: e3b0c4_56=3stn1bn3ebdb8v; _token=3stn1bn3ebdb8v.1789916920.3.2a613f08e177c91dc5daac4464d33f4b; _subid=18uumd0.38.6oqe\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Sat, 19 Sep 2026 15:08:41 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, must-revalidate\r\nexpires: Sat, 19 Sep 2026 15:08:41 GMT\r\npriority: u=6,i=?0\r\ncf-cache-status: BYPASS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ajqU6%2FaZt3U2HCt09GCcrAvCg%2FyQiujWzdSK3Xn3keeVvYhfvkLHSRefkZDMFBuMDFPwGhQY8zl28f8%2FBy3aQNCbwzFCGKxKUS%2Fer9p4PsExPofMe4fZpzojpxI%2FCR%2BCEQ%3D%3D\"}]}\r\ncontent-encoding: zstd\r\nvary: accept-encoding\r\ncf-ray: a3d981d47a7fb4f9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9,"size_decoded":730,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"9d1ead73e678fa2f51a70a933b0bf017","sha1":"d205cbd6783332a212c5ae92d73c77178c2d2f28","sha256":"0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5","sha512":"935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34","ssdeep":"","tlshash":"a250000c0003c3cc0000003030c0000000000300300000300000c000000000000c000c","first_seen":"2023-03-08T03:03:03Z","last_seen":"2026-09-19T19:55:18.496071Z","times_seen":91520,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/firebase-prewarm.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=","date":"2026-09-19T15:08:33.362Z","timestamp":1789830513362,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"GET /2a259d6f-16c0-4e53-8cab-de36eb7005a0/firebase-prewarm.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T15:08:33.478Z","timestamp":1789830513478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=\r\nCookie: cl_st=b\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: text/html\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a54864b500-OSL\r\ncf-cache-status: DYNAMIC\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KPpJGSQln7cniqufp0KcVCa1NKkbXUL6dSarzF6stFme2xf7LRGz4YTu1WHWsQs0B1H6ErdVPLTYLyldQdfoZEDkJ94Fm%2FyKHTDL3O1k67pjMmg83R5Abqub64K8sEZE%2BS1njvwwFJqB6mY%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1216,"size_decoded":1258,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"d7d744b2dd09ee9271c23913224b9819","sha1":"41bc7f331fd09a146906616f9d82f2c019543922","sha256":"18ea57d1a00f26dbfda04e4206e405d28a36b12c8a02c588a886b5d708d8b0b1","sha512":"1b0c9bf32e157a03f075a2b494dc663493949a5e2596bf407305802ab86bf48d8e04893a3b47f8a3ac6ff1c397f3517fde8a3ffbafe56b6c03f86af74afc4ef8","ssdeep":"","tlshash":"6e21c26558a72125b123c4142af4a5086eacd507d30bec507eeda18dcfc9649d9c32a9","first_seen":"2026-07-28T16:49:00.967594Z","last_seen":"2026-09-19T15:09:12.029594Z","times_seen":3,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/play/js/getSafeDate.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/play/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ","date":"2026-09-19T15:08:33.833Z","timestamp":1789830513833,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"helvar-goldenorbit.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 25 Aug 2026 07:39:26 GMT","end":"Mon, 23 Nov 2026 08:37:56 GMT"},"fingerprint":{"sha1":"62:FF:80:55:A7:00:B1:1E:2E:F4:57:8E:87:E8:38:25:F3:45:EE:12","sha256":"34:72:29:B9:27:D7:42:BA:A1:26:3F:84:62:50:BA:15:D2:65:3E:D6:91:D5:44:64:34:23:F2:3E:5A:C9:D0:D4"}}},"request":{"raw":"GET /play/js/getSafeDate.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/play/js/main.js\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vtBVRNQytxF7%2BNtj92YQFiWu21pnN8Eud%2FbVOw%2BLJGQt9YjMsRUuecBpoHoDFuMsyuS1rT2I5baCoAekdm2jJp8jwth5%2BiTBIjE7ZOH1uCL9CNZL6xp3l%2BKeHOTyIfM%2B%2F3PY%2BJiGzyW0uI4%3D\"}]}\r\ndate: Sat, 19 Sep 2026 15:08:33 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: zstd\r\ncf-ray: a3d981a77885b500-OSL\r\ncf-cache-status: HIT\r\netag: W/\"6a914533-9e\"\r\nage: 1081\r\ncache-control: max-age=14400\r\npriority: u=3,i=?0\r\nlast-modified: Fri, 28 Aug 2026 08:22:11 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":158,"size_decoded":839,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"8701eae7ebe3667f4fbf2fb6301051a6","sha1":"e50d44534b75efe129ac89ad2cec497aef2b87cb","sha256":"f86090e864d2898bd6faa6056552735513677a010e666aec982fb28e8b0817d2","sha512":"381aa5901928bebf85166327cc97ff893c959084fb0594ed706df20f75cba66ffb6991bc6d77b0a504278314301f5f2003377389ee52a28d574905785641111a","ssdeep":"","tlshash":"a0c08c0c22bcb30402023b7c02470684ba48a4232fcc8cf9b60db3801f92030c0ba2ca","first_seen":"2026-07-28T16:49:01.018799Z","last_seen":"2026-09-19T15:09:12.035865Z","times_seen":3,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/jQuery.js","fqdn":"helvar-goldenorbit.click","domain":"helvar-goldenorbit.click","tld":"click"},"ip":{"addr":"172.67.143.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=","date":"2026-09-19T15:08:33.363Z","timestamp":1789830513363,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"GET /2a259d6f-16c0-4e53-8cab-de36eb7005a0/jQuery.js HTTP/1.1\r\nHost: helvar-goldenorbit.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://helvar-goldenorbit.click/2a259d6f-16c0-4e53-8cab-de36eb7005a0/?lead_info=bGVhZF91dWlkPWFlYzZlNzhlLTgwZjUtNDBjMS1iNmNiLTNlYjBiNDk2OGU2YiZvcz1XaW5kb3dzJmxhbmd1YWdlPWVuLVVTJm9mZmVyX3VybD1odHRwczovL2FyZWR1cXVpei5zaXRlL1RWUmZGekQ3P2xlYWRfaWQ9YWVjNmU3OGUtODBmNS00MGMxLWI2Y2ItM2ViMGI0OTY4ZTZiJnRyYWNlX2lkPWY3MzgyNzIxLWVjNzMtNDBkYy1iNjc1LTk4NDQ2MWY3MmRlZQ\u0026is_webview=false\u0026pixel=\u0026fbclid=\r\nCookie: cl_st=b\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T19:41:56.302058Z","times_seen":18554623,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"helvar-goldenorbit.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"helvar-goldenorbit.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}