{"report_id":"f8e81573-a449-4730-a196-923c1d424e72","version":0,"status":"done","tags":[],"date":"2026-06-08T13:35:02Z","url":{"schema":"http","addr":"tsgateway.non-steam.com","fqdn":"tsgateway.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":0,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"title":"Non-steam client panel","dom":{"size":4639,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"024a015a8e652b4670c07a9c85269516","sha1":"6a470cd66360d6243e054dbb8ed073c3c7efe06e","sha256":"96653b71d17c91dfd39f7aba5789e9321f6999d768cf11209ba5b9e337f21f18","sha512":"3934ee91baee1dd70f8d29018c80cfadd0ab739f9f5faf2a09bd4c5f94ad75cff2c47313adda18ada62a5e232cc85c0dfcd54a1c8da3efd4c62d0d3578c557ba","ssdeep":"48:OdQv19ZY6u2IjTwALLF9DLlsY9kh6WfneBOITwu6HiXv6UJtEMYEKrwZQpQ:OI19ZDu2y0ALLPDLlsPXfnegMAVEZuQ","tlshash":"c7a120614cf56867024380ca727aae0aadd1da17fa5b598433fd57cd0fe7d42c80ba1d","dom_hash":"domhashf07407e9398fc49daaa969be5aaa751c","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tsgateway.non-steam.com","fqdn":"tsgateway.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":0,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T13:35:02Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":8}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"tsgateway.non-steam.com","ip":{"addr":"81.91.178.184","port":80,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2019-08-23","domain_rank":0,"first_seen":"2026-06-08T13:27:36.397916Z","last_seen":"2026-06-08T13:27:36.397916Z","alert_count":8,"request_count":2,"received_data":619,"sent_data":900,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]},{"fqdn":"non-steam.com","ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2019-08-23","domain_rank":1608609,"first_seen":"2026-04-29T03:47:10.059749Z","last_seen":"2026-06-08T13:32:08.060181Z","alert_count":40,"request_count":10,"received_data":853353,"sent_data":6143,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"non-steam.com/build/js/app.e801413a.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"70b9106d07f3776e0c496cce68f87a87","sha1":"9662b57e1df9b6ff9a879bcd93ba394d8b58edef","sha256":"1b4cd7047eb43893972b9a58067d4ea4eeb5824706adb7e6486b7ab836da1cfe","sha512":"3ba0093c800ddc561c5972a3da75720b5dc9156eb163008c241258b7bfb83b0a29586e6ae2f2162228e59cf1a3f46548eb1f91748fc40410f9f6175efa45bcd0","ssdeep":"192:bHvlG5WePiUcaB/SIcWvV2WMfQBUXS68z4zx4WdckDBWlHOgm/VW:Lo5WePi4B/SC92WMIyXS68z4t4WdxWVT","tlshash":"9d32f8d87515306066af2096a02f25177826f57e981f5420a15a58f93decfcea133f3f","size":11818,"data":"","first_seen":"2025-08-03T17:04:22.999933Z","last_seen":"2026-06-18T04:27:09.717733Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4df696a97910cafed45a22fe1e19525","sha1":"5dddb14a528bce3ebae48717c0ac45cd6ba91ee1","sha256":"57fa0cb15d477f81e15ce2d924fe1d1da6c454caba9f1e85d025d67b33ede649","sha512":"119790921eea8a0f176b4b57c318f902e16ddfa589b84f8f41e559a8adce7705ffc6046688105b1ce482465886e327095db3469292746a7495ed654ec2fd0fae","ssdeep":"","tlshash":"91f082fa8c3b4051c651c5e3432f146524107d2b3821c5c87bb9cb559e92f80e4567ef","size":486,"data":"","first_seen":"2026-06-08T13:32:59.315908Z","last_seen":"2026-06-18T04:27:09.741046Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"53707ca73c3de8a07c9c3d1e63e9bf2c","sha1":"fa913db5d8b01463c784674c4cef36deaf6dfb82","sha256":"831d6ddae886c03d0b690d1f48a187b3430f26e941456f5e029b43441adab09d","sha512":"0e128a4ebf73bb7a2c8952dfcd507aa96cdadefd1b19c8a0270c5b732fbd7e7da764dbc2b19625cf26a8ccd7457bb780ebd5ad13d1e60cce6d5066e934ae8de8","ssdeep":"","tlshash":"98b0921a49629a4a59a7b25d4d68f4041014a4ab960918287e1d021a1fa2918c8a9278","size":124,"data":"","first_seen":"2026-06-08T13:35:07.974338Z","last_seen":"2026-06-08T13:35:07.974338Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/runtime.c2980329.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"60aeb948706b140fe7e3d5ef5a876260","sha1":"620a1c5147f26db32f0d4c19a95d216a6371ea43","sha256":"5fca017eb9c96e7b8382dfcf5f8edf9a20500f32a948d9fc1f48efc37d297ec0","sha512":"930af573c8fa3e2baaee149d0eda5ce2effafb35991c31c93a65a9469bb761c33704b4664bc8a43ed9e31efbb2afa2ac43311cced4ad4f5d844d6fa6400b2996","ssdeep":"","tlshash":"e121549531e4f8e427e6d8c5091f8047e612d973517ee8f1e32bcca13828a920177eb7","size":1428,"data":"","first_seen":"2025-08-03T17:04:22.993277Z","last_seen":"2026-06-18T04:27:09.738568Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/755.43aadddf.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"08e7640bcab8fd1ece626495ee61d7ae","sha1":"d519a7e330a932d9cd50a240c36328041b63858a","sha256":"46b47041f30a3156db035a62b017876285afbeebd59d735e033b58291e9be0c9","sha512":"871fb6fc2b35078fd1880accbacd90ea05a3a9e797c87527682e3a4644708ee8c92ec5e8694e58014d36f1db9eeca3cba32e6469563a74b009ebbdae12536272","ssdeep":"1536:lfRLi9gxGUs+4Ezy4bx60BW1kkWyAuxPb8vJ5pDVGf9oOcENMnEBt0AIH6ia/YIX:lfStPAvJ5TlllAYlYgP+","tlshash":"70930addb2cab06347a770ba40bf550bf2361999684d4400f125e4e9bc78b4a927bf3d","size":90006,"data":"","first_seen":"2023-03-11T22:22:29Z","last_seen":"2026-06-18T04:27:09.713496Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/809.dd650ea1.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b188f053f6825bbae4903ab45c6dbf3","sha1":"bfc0b0fe939628aac186f9a689999d9a852fee01","sha256":"e522a006bfeb6aec5452806c317393a1e0677587d756c9758370e7de0b8e741f","sha512":"9a0fa946ad66a575c589e187470ad6a9c33d726896fdeb4b9ad7c0004ac1ab9d3bc4c9cff901977bb16afa9abec535fdc96d617db344e9769d88996fa5ebfd3e","ssdeep":"3072:YhgN1QneuB1DGusRwxKTHDAtz1MPaH+8uQS04EJOu5LCT0Ef5IrGt+6ad7Nw/Sov:ckOdyP1eOeuwI5IrGtNaQS0R","tlshash":"da94054db2417532429ba1a6107b1a0fb2376a2da106809cb57ccdde5ebcd48327bf7d","size":414540,"data":"","first_seen":"2025-08-03T17:04:22.997062Z","last_seen":"2026-06-18T04:27:09.71509Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"tsgateway.non-steam.com/","fqdn":"tsgateway.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":80,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:34:32.734Z","timestamp":1780925672734,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: tsgateway.non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: ddos-guard\r\nConnection: keep-alive\r\nKeep-Alive: timeout=60\r\nSet-Cookie: __ddg8_=Ong3XC5xT0ZKPEwm; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:32 GMT\n__ddg10_=1780925672; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:32 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:32 GMT\n__ddg1_=Ke98Nyk9sRGSiENRDEiG; Domain=.non-steam.com; HttpOnly; Path=/; Expires=Tue, 08-Jun-2027 13:34:32 GMT\r\nDate: Mon, 08 Jun 2026 13:34:32 GMT\r\nContent-Type: text/html\r\nContent-Length: 185\r\nLocation: https://non-steam.com/\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T19:29:47.282605Z","times_seen":16587932,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":4,"connect":21,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/235.c3078fc7.css","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.406Z","timestamp":1780925673406,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/235.c3078fc7.css HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=fa1gsG0bzbx6kpZT; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: text/css\r\ncontent-length: 34722\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-87a2\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":34722,"size_decoded":35243,"mime_type":"text/css","magic":"ASCII text, with very long lines (15427)","md5":"9eec6156d933d2944499cd6fc68311e1","sha1":"36a00bb3651e80da426551a5185121943515d48a","sha256":"5c2e87b849647f3ad0b9d73e8ba458ccd32c75cd877e2de0f364c05ba61734b3","sha512":"98b5d8be8938f1e95b7d514fcb1acfd893ebef5b8dbeb999f4c32025f5af533841a31638b4ced533bef1e7320950bfd33b0ffbaf0a3b88402b0f7c3eaa68ae2d","ssdeep":"384:pCwiEt7Cksa5cvR3u1e73CwiEtgUJwamiHWu4G6IzvgSc7nfZBhVLV:slEt+NJslEtgUJHmnu4G6IzvgBhL","tlshash":"38f27530a583242efe33c13460e15ef4522bc146eda64fbca05af65a53e68e8d47b971","first_seen":"2025-08-03T17:04:22.990353Z","last_seen":"2026-06-18T04:27:09.734852Z","times_seen":20,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/runtime.c2980329.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.416Z","timestamp":1780925673416,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/runtime.c2980329.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=L47A0EHNBrHZsESm; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 1428\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-594\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1428,"size_decoded":1961,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1428), with no line terminators","md5":"60aeb948706b140fe7e3d5ef5a876260","sha1":"620a1c5147f26db32f0d4c19a95d216a6371ea43","sha256":"5fca017eb9c96e7b8382dfcf5f8edf9a20500f32a948d9fc1f48efc37d297ec0","sha512":"930af573c8fa3e2baaee149d0eda5ce2effafb35991c31c93a65a9469bb761c33704b4664bc8a43ed9e31efbb2afa2ac43311cced4ad4f5d844d6fa6400b2996","ssdeep":"","tlshash":"e121549531e4f8e427e6d8c5091f8047e612d973517ee8f1e32bcca13828a920177eb7","first_seen":"2025-08-03T17:04:22.993277Z","last_seen":"2026-06-18T04:27:09.738568Z","times_seen":20,"resource_available":true,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/img/favicon.ico","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:34.884Z","timestamp":1780925674884,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=fa1gsG0bzbx6kpZT; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GiAGfBImIVwuvgp1; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg10_=1780925674; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\r\ndate: Mon, 08 Jun 2026 13:34:34 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 38554\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-969a\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":38554,"size_decoded":39079,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"231913fdebabcbe65f4b0052372bde56","sha1":"553909d080e4f210b64dc73292f3a111d5a0781f","sha256":"9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad","sha512":"7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919","ssdeep":"768:PcaDYrV5KBau+3erpKn9jpe7z9mWAFjQcR4D9DQ0LKfjLh:PcsiV5Y+erc9T/H4f0jLh","tlshash":"70038de82e4917aee9e2cf324adb6716237b4f88c0bc169742b07f193175a51c6d78c1","first_seen":"2023-04-05T07:02:49Z","last_seen":"2026-06-20T19:21:01.025301Z","times_seen":6550,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":132,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/sound/icq.mp3","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:34.895Z","timestamp":1780925674895,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /sound/icq.mp3 HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=fa1gsG0bzbx6kpZT; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=l6yMem96wBqNhhx3; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg10_=1780925674; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\r\ndate: Mon, 08 Jun 2026 13:34:34 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 8768\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-2240\"\r\ncontent-range: bytes 0-8767/8768\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8768,"size_decoded":9302,"mime_type":"audio/mpeg","magic":"data","md5":"fd7eb21974e89390513d726a137ff482","sha1":"5fd62766c4be5de1665e7743954eaa43489b59bb","sha256":"a938983c2ec2f74f85eff6a3a03d5144d90cd52bb1fa7a11d0c8a565de5b4aea","sha512":"f50d0e58acb876efba3c3fefc6f041730f00aa354dcb03bc8230cb4a0af5c1384d03137e369a82cadf701d6466138631ea6323d67ed50b4ae068c2f25da559a1","ssdeep":"192:N0c2ePiiMuk2/hZKDhMtJGL0sco/egePC42EdT0ld5frtnij:NBiiMnQ4uAL0sCkEdMHN2","tlshash":"a2029ef64cc14067d2e70f7798127424eda4bad2e57520e03e6e45ed63d7700c8d5072","first_seen":"2025-08-03T17:04:22.982826Z","last_seen":"2026-06-18T04:27:09.727695Z","times_seen":20,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:34:32.937Z","timestamp":1780925672937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=Ong3XC5xT0ZKPEwm; __ddg10_=1780925672; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=WqIy0dXkGUSazXqg; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\nPHPSESSID=m0osenpevo4dg4fufq1pr210hs; path=/; secure; HttpOnly; SameSite=lax\nRememberMe=deleted; expires=Sun, 08-Jun-2025 13:34:32 GMT; Max-Age=0; path=/; httponly\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: no-cache, private, max-age=0, must-revalidate, private\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT, Mon, 08 Jun 2026 13:34:33 GMT\r\nexpires: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":4678,"size_decoded":2588,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0e57e660b8b345c4151bfbcadda477ca","sha1":"6fdda34fee7fc3a124a02c789e87122269c02f61","sha256":"1ca1c1b0e0501afdbbde29e398bc5be6e466287edcb9d2e420bafd424c17c0ff","sha512":"98097ae6dde1a006c4cd4ac8d84e29427b640a16c804b8a6c3c177502ca32dcf4820c746bd7bf4b10b7f4ccb82532aeca28afef11cc9227da0540f9f51d0c457","ssdeep":"48:YaQv1vZY6u2IjTwALLF9DLlsY9kh6OufneBOITwu6HiXv6UJtEMYEKrwZQpu:YX1vZDu2y0ALLPDLlsPFufnegMAVEZuu","tlshash":"83a121614cf56467024380ca727aae0aadd1da17fa5b598433fd67cd0fe7e42c80ba1d","first_seen":"2026-06-08T13:35:07.969598Z","last_seen":"2026-06-08T13:35:07.969598Z","times_seen":1,"resource_available":true,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":6,"connect":22,"send":0,"wait":130,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/css/app.69de329a.css","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.413Z","timestamp":1780925673413,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/css/app.69de329a.css HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=rfOHpi5l5nv1XExH; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: text/css\r\ncontent-length: 210337\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-335a1\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":210337,"size_decoded":210860,"mime_type":"text/css","magic":"ASCII text, with very long lines (65308)","md5":"7205b806bc43a3ccc45aba3575a57b93","sha1":"3bacb05ba254bb3eb63005ec71879f8c38bcfc54","sha256":"2908bc8966d29be2e198fa69863259762eafb08a49be590533a20fe81ed71ead","sha512":"8892bf55ebb61d3dfe2339d99ffbbb2c898b021f2068ea7df693fff1e5d236be4f71a72f73313b824f6dd63c88dc912a03b8e39a06bacf7101642ef607cbced0","ssdeep":"3072:ND7aUmq3SYiLENM6HN26E5+pCkiBwQiy5:ND7Bmq3SYiLENM6HN263CkiBcy5","tlshash":"a824a5a9f58420f8e37bc91f95e0b6b9153fe655d2110f9af01bab188bc52c605a3f0d","first_seen":"2025-08-03T17:04:22.979656Z","last_seen":"2026-06-18T04:27:09.712035Z","times_seen":20,"resource_available":false,"data":null}},"time_used":693,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":558,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/755.43aadddf.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.417Z","timestamp":1780925673417,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/755.43aadddf.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=SaxKzjklmfBT66NN; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 90006\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-15f96\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":90006,"size_decoded":90542,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65464)","md5":"08e7640bcab8fd1ece626495ee61d7ae","sha1":"d519a7e330a932d9cd50a240c36328041b63858a","sha256":"46b47041f30a3156db035a62b017876285afbeebd59d735e033b58291e9be0c9","sha512":"871fb6fc2b35078fd1880accbacd90ea05a3a9e797c87527682e3a4644708ee8c92ec5e8694e58014d36f1db9eeca3cba32e6469563a74b009ebbdae12536272","ssdeep":"1536:lfRLi9gxGUs+4Ezy4bx60BW1kkWyAuxPb8vJ5pDVGf9oOcENMnEBt0AIH6ia/YIX:lfStPAvJ5TlllAYlYgP+","tlshash":"70930addb2cab06347a770ba40bf550bf2361999684d4400f125e4e9bc78b4a927bf3d","first_seen":"2023-03-11T22:22:29Z","last_seen":"2026-06-18T04:27:09.713496Z","times_seen":40,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":339,"receive":241,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/809.dd650ea1.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.419Z","timestamp":1780925673419,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/809.dd650ea1.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=NQXzfziW83dCc86Q; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 414540\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-6534c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":414540,"size_decoded":415077,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65466)","md5":"2b188f053f6825bbae4903ab45c6dbf3","sha1":"bfc0b0fe939628aac186f9a689999d9a852fee01","sha256":"e522a006bfeb6aec5452806c317393a1e0677587d756c9758370e7de0b8e741f","sha512":"9a0fa946ad66a575c589e187470ad6a9c33d726896fdeb4b9ad7c0004ac1ab9d3bc4c9cff901977bb16afa9abec535fdc96d617db344e9769d88996fa5ebfd3e","ssdeep":"3072:YhgN1QneuB1DGusRwxKTHDAtz1MPaH+8uQS04EJOu5LCT0Ef5IrGt+6ad7Nw/Sov:ckOdyP1eOeuwI5IrGtNaQS0R","tlshash":"da94054db2417532429ba1a6107b1a0fb2376a2da106809cb57ccdde5ebcd48327bf7d","first_seen":"2025-08-03T17:04:22.997062Z","last_seen":"2026-06-18T04:27:09.71509Z","times_seen":20,"resource_available":true,"data":null}},"time_used":1296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":965,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/build/js/app.e801413a.js","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:33.421Z","timestamp":1780925673421,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /build/js/app.e801413a.js HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=WqIy0dXkGUSazXqg; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=1xuVSntQhiJWmwQz; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg10_=1780925673; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:33 GMT\r\ndate: Mon, 08 Jun 2026 13:34:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 11852\r\nlast-modified: Thu, 17 Feb 2022 19:41:39 GMT\r\netag: \"620ea4f3-2e4c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":11852,"size_decoded":12387,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11334), with no line terminators","md5":"70b9106d07f3776e0c496cce68f87a87","sha1":"9662b57e1df9b6ff9a879bcd93ba394d8b58edef","sha256":"1b4cd7047eb43893972b9a58067d4ea4eeb5824706adb7e6486b7ab836da1cfe","sha512":"3ba0093c800ddc561c5972a3da75720b5dc9156eb163008c241258b7bfb83b0a29586e6ae2f2162228e59cf1a3f46548eb1f91748fc40410f9f6175efa45bcd0","ssdeep":"192:bHvlG5WePiUcaB/SIcWvV2WMfQBUXS68z4zx4WdckDBWlHOgm/VW:Lo5WePi4B/SC92WMIyXS68z4t4WdxWVT","tlshash":"9d32f8d87515306066af2096a02f25177826f57e981f5420a15a58f93decfcea133f3f","first_seen":"2025-08-03T17:04:22.999933Z","last_seen":"2026-06-18T04:27:09.717733Z","times_seen":20,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"non-steam.com/sound/newFriend.mp3","fqdn":"non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"81.91.178.184","port":443,"asn":204601,"as":"Zomro B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://non-steam.com/","date":"2026-06-08T13:34:34.899Z","timestamp":1780925674899,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"notexistsbilling.non-steam.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 05:43:14 GMT","end":"Tue, 14 Jul 2026 05:43:13 GMT"},"fingerprint":{"sha1":"64:EF:75:B4:01:FE:6E:C3:06:12:BC:2B:C9:B3:FE:96:59:ED:9A:DA","sha256":"8D:EA:48:17:FC:1E:D9:45:47:08:FD:8F:0E:20:9F:DC:81:26:E6:7C:C3:8E:86:EA:E2:23:25:53:56:EF:43:41"}}},"request":{"raw":"GET /sound/newFriend.mp3 HTTP/1.1\r\nHost: non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://non-steam.com/\r\nCookie: __ddg8_=fa1gsG0bzbx6kpZT; __ddg10_=1780925673; __ddg9_=195.64.118.152; __ddg1_=Ke98Nyk9sRGSiENRDEiG; PHPSESSID=m0osenpevo4dg4fufq1pr210hs\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: ddos-guard\r\nset-cookie: __ddg8_=0A1U3kdQvvlk7OjZ; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg10_=1780925674; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\n__ddg9_=195.64.118.152; Domain=.non-steam.com; Path=/; Expires=Mon, 08-Jun-2026 13:54:34 GMT\r\ndate: Mon, 08 Jun 2026 13:34:34 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 32934\r\nlast-modified: Tue, 14 Jan 2020 12:41:13 GMT\r\netag: \"5e1db6e9-80a6\"\r\ncontent-range: bytes 0-32933/32934\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":32934,"size_decoded":33471,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"fe059ea5a5153c603f577c0f077286c0","sha1":"89e9f66e4cf91579219cf9dab792eb75042e457f","sha256":"733d4729fdcd28a227b6b254e08186c7c42bb0e609ae01d36521b6ee66071647","sha512":"023002124e9c3c6e680e68e060d697db54167fb1c1439426bf2806482c813179a3e4f2995a4cca4bcdf6b7793ea06ed8ac2848ec772933107e904f15ccb004d0","ssdeep":"384:XBIgZLEEX9nNxSDPV9o4SOlXkNS5MOEGOP3dI3tNwPr/6FeTptt9NJo820:XB3ZjB7S/oUVkM/sPtmwPLLTZ9Hoj0","tlshash":"b3e2c0496be55164f98f2e7e204ff035e9c5acac1c05cfc8ac045f601a7f592be39a26","first_seen":"2025-08-03T17:04:22.986003Z","last_seen":"2026-06-18T04:27:09.729932Z","times_seen":20,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tsgateway.non-steam.com/","fqdn":"tsgateway.non-steam.com","domain":"non-steam.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:34:29.716Z","timestamp":1780925669716,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: tsgateway.non-steam.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T19:29:47.282605Z","times_seen":16587932,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"tsgateway.non-steam.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}