GET /cdn-cgi/phish-bypass?atok=CnsvhRYHHUdlCfiVGb_pADkjMj73TfeFvq3rg64_JYY-1749503308.298073-0.0.1.1-%2F&original_path=%2F&cf-turnstile-response= HTTP/1.1
Host: paypal.heyhelp.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 400 Bad Request
date: Tue, 10 Jun 2025 12:23:09 GMT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mJeyVBdTxd9QFr5Np6J74aMgFapIQVFhSOdbkoq3JV7xuHyftYDBU9GKMGtugVPHcnb%2B2fyPTRCf6u7t4f4Hyrb6R0v8KUDtyEUhliGkDg%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: 94d8d69afc2356cb-OSL
X-Firefox-Spdy: h2

GET /cdn-cgi/phish-bypass?atok=CnsvhRYHHUdlCfiVGb_pADkjMj73TfeFvq3rg64_JYY-1749503308.298073-0.0.1.1-%2F&original_path=%2F&cf-turnstile-response= HTTP/1.1
Host: paypal.heyhelp.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 400 Bad Request
Date: Tue, 10 Jun 2025 12:23:09 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=94OXWzJ78wWLe7W48pH%2FabeRUxVaOdWz1n%2FJ2o9aTO5tldqR22vOdnZEClIpdG%2BvbNzfmvIbtJ2KjljHCT%2FatIfwJlD%2BifLvUqu9HLLkDQ%3D%3D"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: 94d8d69befd70b31-OSL
alt-svc: h2=":443"; ma=60

GET /favicon.ico HTTP/1.1
Host: paypal.heyhelp.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://paypal.heyhelp.cc/cdn-cgi/phish-bypass?atok=CnsvhRYHHUdlCfiVGb_pADkjMj73TfeFvq3rg64_JYY-1749503308.298073-0.0.1.1-%2F&original_path=%2F&cf-turnstile-response=
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Tue, 10 Jun 2025 12:23:09 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: cloudflare
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Location: https://paypal.heyhelp.cc/favicon.ico
Cache-Control: max-age=14400
Cf-Cache-Status: EXPIRED
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b%2BNJsS5PfpLaJRQ9QSPvaZaVfIBWTJkf43Ih5vvxtvdX1Hl25yPjOFXEfasZtQfun7XTqQFaY5srq3Tjgy2FWbbAYthVO01qOlrqSlhrEA%3D%3D"}]}
CF-RAY: 94d8d69cb8810b31-OSL
alt-svc: h2=":443"; ma=60

GET /favicon.ico HTTP/1.1
Host: paypal.heyhelp.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://paypal.heyhelp.cc/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 10 Jun 2025 12:23:10 GMT
content-type: image/x-icon
server: cloudflare
last-modified: Tue, 11 Jun 2024 08:20:01 GMT
vary: accept-encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SMbJIzOf06Ch9MrzikElLIHXCpV4%2Bh%2BIQtg2cefK6n4W5fBpB%2FgJIWBdIi%2BKfVrQTwJVS1buwC%2FdaXeUyYXsKubqlrkg7BJkswnWHyui2w%3D%3D"}]}
cache-control: max-age=14400
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
etag: W/"666808b1-0"
content-encoding: br
cf-ray: 94d8d6a0081cb4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2