{"report_id":"3b955070-e47a-4f63-b1a9-1159d97a0bde","version":0,"status":"done","tags":[],"date":"2026-10-15T04:57:06Z","url":{"schema":"http","addr":"coinbasextensions.com.expresscouriers.net/","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":0,"asn":214036,"as":"Ultahost, Inc.","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"title":"Wal","dom":{"size":36710,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (428)","md5":"61e4e3e9f71288ed4ac27c20c45a70f3","sha1":"f1f29ec2c72cd5a9c03f7b8bcfa5669f970e5dfc","sha256":"164e4654fd0f1660d52f4602e2a32e2ea503fd08f0d7ba99289b2ecc7a4c0daa","sha512":"1d4508f78a5fd2f21f3f678ff92b286daac32a1bdd290179d8d14ca5189e20c9ada37ea0ebd5d5bd4ec8b5fc7a7ba2673b5d2f76d4f8e9ef3ed46fffcfa32639","ssdeep":"384:mLijBD1a+f+cPJ+3W3euVWWew55JoRj/AYDFDQZb5J/SWGAR:mLijBDEoJ+34euVbew5X6+b59SWG6","tlshash":"c1f2c4528efb0735241b83a7b7e21a296ab09003c504d9647fed03b44fca8d599bb6cc","dom_hash":"domhash276c55a706b5918fc3828e3a1b7fb3a5","first_seen":"2026-10-15T04:54:48.275253Z","last_seen":"2026-10-15T05:03:38.57398Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"coinbasextensions.com.expresscouriers.net/","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":0,"asn":214036,"as":"Ultahost, Inc.","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-19T04:57:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"coinbasextensions.com.expresscouriers.net","ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2025-05-31","domain_rank":0,"first_seen":"2026-10-15T04:55:11.473541Z","last_seen":"2026-10-15T04:55:11.473542Z","alert_count":56,"request_count":56,"received_data":14556786,"sent_data":29001,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"30fa9ce652cddb499c58e41fe29f4afe","sha1":"87c1b64e2736d70e5bd343e5640c1ee12ac35540","sha256":"e5458d23dadfbf70b1a69b28f80d6fb4558a43dcc48a81b88d2561348c76d0f9","sha512":"9d81d712bb58a5a312a6e2058b2ae3ec32dd19cb497f3e0b767c5a1bae728f97551823beaed918756f72a28f90228df1fd1b4a28a0b1c69548125117483a93ff","ssdeep":"96:t3VCD+f0j3bvAaAAcmnfHYmYiuTaqBAbrpEIQbEZK:tFCD+fe6vr16CII","tlshash":"93d112a79d7d12ba04abe73babcb8c7cf67310431502c8107e6c8a841f599941bfe6d4","size":6335,"data":"","first_seen":"2026-10-15T04:54:48.502363Z","last_seen":"2026-10-15T05:03:38.66704Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseSans-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:31.279Z","timestamp":1792040191279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseSans-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/popup.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-15T04:56:30.553Z","timestamp":1792040190553,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=0\r\nexpires: Thu, 15 Oct 2026 04:56:29 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 13 Oct 2026 23:03:35 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6977\r\ndate: Thu, 15 Oct 2026 04:56:29 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}],"data":{"size":39860,"size_decoded":7341,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (372)","md5":"cd6f62bcbba35d23aaa7ba457e5719cd","sha1":"968d2eb8874d530ecf6b8f2082b37bbcdb22d1ba","sha256":"cd2ffb60c90897a4368bc2fa4b7897e6df8fcfa720d46376017bec1d9db09178","sha512":"4a7051b62fcd475a9a8a11eb61b5843336c0526b87c2f23d0f01f3808aa41b9ae64abd3f9937d8746172af2ede421e2c6e8241ed30bb5a28d725e1ba3982a9bc","ssdeep":"384:rLwj7D/o+2mJb8dQvbTQcH95LJmiNAyZb5J/SWGA3:rLwj7DAKb8dYbT5d5FK8b59SWGY","tlshash":"bc03a4524efb1674245b83b7b7e21a296a719003c204dd683ffd13b84f8a5d4d9ab6cc","first_seen":"2026-10-15T04:54:48.423842Z","last_seen":"2026-10-15T05:03:38.654789Z","times_seen":4,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":2,"connect":20,"send":0,"wait":25,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7552.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.878Z","timestamp":1792040190878,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7552.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:03:25 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 12864\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43603,"size_decoded":13157,"mime_type":"text/css","magic":"ASCII text, with very long lines (10804)","md5":"fac643909f5e097d7aeaed9d1f0cb309","sha1":"c503e022c721c33d1dc8944993b265d2b00771f6","sha256":"5b2b5a827f4b0652e04ee4bce098d327089c33eb8e08208dc056c51ea2bcd9d4","sha512":"0281ce8ab9308353449d1ecee1792ef4ba5e9ed46be424a89c06cb2355cf18294dbfc228cbf9880ef0b4cbc707500fdf9aa5f3abefda558f5124478b5687efd4","ssdeep":"768:mnIX3BMnpB84HZAN1fUHylOx0xonUi/tgaATQKQH19h7v/pwLsfH+7GhyKet23a:uIX3opBtK8y4nFWJkLz7v/WLsfH+7G+","tlshash":"f61318de9fa93c84efc5090a64df65d7102d67c72c32299d898dabc44d6e48a3be413c","first_seen":"2025-08-03T23:22:09.763803Z","last_seen":"2026-10-15T05:03:38.657579Z","times_seen":11,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseSans-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.858Z","timestamp":1792040190858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseSans-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/2573.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.874Z","timestamp":1792040190874,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /2573.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:54:34 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2833\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2833,"size_decoded":3080,"mime_type":"text/css","magic":"ASCII text, with very long lines (2796)","md5":"1fed355d18404cdfbd9414e0fa21bbd8","sha1":"1825125802e0dd52a720de9d940185c9e6910c17","sha256":"a61159563399b4f1b80df9270541ceb02d39f81d76fa1a824858671275bb8f4a","sha512":"ea7b55a118377803924cc066702deb46fe7f851735a4d18ef872d92a69bbe597af2e1c0a4de0887188b1b864902d36a303f533954580c91cde1537f3d5688c17","ssdeep":"","tlshash":"5b51d3c85704893d5546adeca39c6f9be561b54006320df33a5713b616dbace73bb0c2","first_seen":"2024-10-12T13:57:36.245536Z","last_seen":"2026-10-15T05:03:38.651455Z","times_seen":16,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/9959.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.887Z","timestamp":1792040190887,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /9959.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:06:12 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 12985\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":41452,"size_decoded":13278,"mime_type":"text/css","magic":"ASCII text, with very long lines (10760)","md5":"ace38b15571ee53ff2d178e82827c8c2","sha1":"16cd66b590596058ef589bf085b9ed8030aceedf","sha256":"cb0f3b9dc6109a1e2a9b9c37b31825b499a887ea78ea7cd7f206bc773f2aa279","sha512":"5e633d8dbf6e332819519d79422a8c6253190a279ceb68f4b51d2683eca4634483166f8fa72c07bbe920dd1ea419457b30aef713e3d23e39cde16f63fb42fcc1","ssdeep":"768:DoHeXQ7B1QSNqv9YcPObevnrEjBxp5zNToT0fOxc7c8Uor7Pg/dEbEzsDnFeMlFK:DZQNeSa9YMOyvn4dxpHj26AQr7zSsDnk","tlshash":"f71318cedea93d98ebc4180aa5cf62c7015d27871c72198c554cfbc949aa58d7bf023e","first_seen":"2025-08-03T23:22:09.882283Z","last_seen":"2026-10-15T05:03:38.631801Z","times_seen":11,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7870.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.925Z","timestamp":1792040190925,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7870.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:04:00 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 9502\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28932,"size_decoded":9794,"mime_type":"text/css","magic":"ASCII text, with very long lines (10760)","md5":"28aa1270a487d72880000bcb04708520","sha1":"5c72a742af0cdafbe9ba8ff7748f18b84b1c53c2","sha256":"617c940c63bbe7f2e43711b4cc27b5c70392a98430f753fd7e3e63d4419a73cc","sha512":"a450e16437bb5f1f8043249a815ccc078f73b844dd65ee403510ac9881add088cfb747026826675bab13f265de8feb311c669f6ed09245d26e0a9dd7cec58691","ssdeep":"768:ewQKWFwGIIEO9KrzRzXt+qYLRlVOdHNqv9YcPObevnrEjBxp5zNTo+:ewtWxOO9WRd+qYLRlVEa9YMOyvn4dxpr","tlshash":"3bd207cdcead3d98fbd1150a75ce66c7014d27972c71258c8649ffc989aa1893bf022e","first_seen":"2025-08-03T23:22:09.870236Z","last_seen":"2026-10-15T05:03:38.592237Z","times_seen":11,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseText-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.861Z","timestamp":1792040190861,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseText-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/5672.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.907Z","timestamp":1792040190907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /5672.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:58:29 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7123\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":21639,"size_decoded":7415,"mime_type":"text/css","magic":"ASCII text, with very long lines (7020)","md5":"04322c9a2e793545192d1910da56fd60","sha1":"5ef99d2f89893f92768b6943bf2b1ca9696f4e56","sha256":"dab548c0910cede48c2a3219789aac6c12e4db558e3b32331bfea19dc04b1641","sha512":"e5e7308afd80a22e2fec172b49a59cd5097fc1a2ce135a9f648807b3312374ccadeefafff32438eddbba05b6803a7bc92ff59668be56cd2c93aa2c99b75c6bfc","ssdeep":"384:q6jp7K49wuWxkgKflk7x7AuFVk2EdDd5lcosSRpoTSSumC1Ey3dDWKfXXeUbsVnV:qKp94z6l07AhR0umCeVBVavAYTh+","tlshash":"44a2c685cfa73c89dfd60a0966ce21cb025e5b4b187215cd651eb7c40a6d8ad3bf017e","first_seen":"2025-08-03T23:22:09.872993Z","last_seen":"2026-10-15T05:03:38.642304Z","times_seen":11,"resource_available":true,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/1927.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.927Z","timestamp":1792040190927,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /1927.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:54:26 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6232\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6232,"size_decoded":6479,"mime_type":"text/css","magic":"ASCII text, with very long lines (5096)","md5":"c76b42ea43295c6c670aa5a6818c12e0","sha1":"770b87ea666143e9e4e36a56518b9a4f12600aa5","sha256":"7cf8992992eaf74f11200966e56a1f2c30b046fa1edd266fac080f95b0087e0a","sha512":"4c338c994a0a8256ad511f0e0ecebe9fab0bcb1b459d658ede5e1d1a254d2ae69e5c1d1fbc8935d5e979258fea05e5ad2534c9cf7ec2e0d5c27cf898bf8bee5e","ssdeep":"192:J2AFJGrWn3kL9PSmHiZs5FCMynBJr71semORzLz/vo:J2EO9PSgiv9D9wORzLzHo","tlshash":"5ad1e7c9ddb86c24f7654a0962cedac9104cb7a72c3221c9d988f7c48d9a0ed3bd126d","first_seen":"2024-10-12T13:57:36.313624Z","last_seen":"2026-10-15T05:03:38.606459Z","times_seen":16,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/ga.js","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.840Z","timestamp":1792040190840,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /ga.js HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1042,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/686.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.870Z","timestamp":1792040190870,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /686.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:53:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6990\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":21748,"size_decoded":7282,"mime_type":"text/css","magic":"ASCII text, with very long lines (14944)","md5":"4d87e7370578244b81927a08245c76d8","sha1":"cf3a237db50cd8a4ccc61db3bf6628b666a4ca42","sha256":"57448438098f9a3bf3e7aab0e20eb66023c89a7476c4dba749452f70ebf48ec8","sha512":"c1b687bab74dc6e38aa5cf57e921aab2a38b1f19628997b5c62d4f2473e3825ebf459ceaf7ab8b3a79ea48e79c5fdae987bb38945f2d979a16427bdaf66b475a","ssdeep":"384:NdeyIyCuqY7tLmGkW20cfZYC8u232sPyCB6N00Y4qA9RdYLDTyDkHisBZ3:DaktLZkWPcfZYC8u232ayCwQMdQIs/","tlshash":"c6a209c6df8ebd39ff88880aa6de75e3411f13471ca7007d544e67c54a5b4ea6ae082c","first_seen":"2025-08-03T23:22:09.816571Z","last_seen":"2026-10-15T05:03:38.65699Z","times_seen":11,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":90,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/9687.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.872Z","timestamp":1792040190872,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /9687.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:06:05 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 8404\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":25599,"size_decoded":8696,"mime_type":"text/css","magic":"ASCII text, with very long lines (10804)","md5":"243870c976ce4e615641a01b06730380","sha1":"208a7d55927e7dd41d0b9092121275558d2b4cb2","sha256":"c86f5fbe1aaf701a312a9c5ab1fb687e327b1e0aa2ea76fd444e05feee8fa84d","sha512":"3e7463bc8eb2b8845f75f61a53102c24a3daa17f5ae8cad3eca983875da61cd36635aa58d982866de4d5282b7ccad1cb2977decb5440c7c6f08c4c536acb8932","ssdeep":"768:DaATQKQH19h7v/pwLsfH+7P8aUdaLxvsuZK0X:DJkLz7v/WLsfH+7xUotIK","tlshash":"56b219eece593c98ef81090b68ce55d7106f3b931c31298c89adabc54dad89933e417c","first_seen":"2025-08-03T23:22:09.76882Z","last_seen":"2026-10-15T05:03:38.614084Z","times_seen":11,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7344.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.889Z","timestamp":1792040190889,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7344.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:03:09 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 5324\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":15859,"size_decoded":5616,"mime_type":"text/css","magic":"ASCII text, with very long lines (15788)","md5":"3fb18e41a292ab58ca349384adeeb698","sha1":"4f57277d10c20af5eca8fa435f0763eba339decc","sha256":"ce9a75bb1afb30e375bc7725034e2d61d2a06931462e735ea4b36e2d891ab2c4","sha512":"1e8d591ba77102ba40ae8011f81618a3b80ef54e3475b3a138a7aa03b58cfca109d0f27ccd8815756ad673996548f7f912143cccf3c0cdbc4ef1c9f9332fe15e","ssdeep":"384:806hNdBKOr9UvvTvY9IiUKW8JBPgkNsTafnqZBA4RwdiMi2/2:RUNWvTv+NszBA4Rwdi32/2","tlshash":"4462f9ae9e6c3c49e7c9480561cf71d6c16d038b3c21196d8d8cfbc5c4ae5ca36e4569","first_seen":"2025-08-03T23:22:09.84234Z","last_seen":"2026-10-15T05:03:38.650501Z","times_seen":11,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/572.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.894Z","timestamp":1792040190894,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /572.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:53:40 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4827\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13335,"size_decoded":5119,"mime_type":"text/css","magic":"ASCII text, with very long lines (7048)","md5":"4a78f969d164c7eed9a752f6100008eb","sha1":"a74384649837093502193d7f2de0921c489c0e39","sha256":"c8913a9daba113620cddf4554b4fc4e862568466def3d1dbfa6fe8b815e98601","sha512":"a46101a47c7bd48b0cf92fe4e1f2a51cd1af10852d83c3abe51ee5594b1fb260493985a5e4dac7e32435c7bf7c096517125b4e95b4e3c0b174f9c36799fc62d1","ssdeep":"192:v5JbxvvXf636BnELu4nUMe3vQdzdJSVW8zNPzl4P6NdPkcSzI3e:RJtvvSKxjxvHJPz6P6NOP","tlshash":"ce52f89f8e697c4ceb884d89edce51db223d3b930c222a8cc46cb6c2495d45523d627d","first_seen":"2025-08-03T23:22:09.864215Z","last_seen":"2026-10-15T05:03:38.588169Z","times_seen":11,"resource_available":true,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8797.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.893Z","timestamp":1792040190893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8797.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:37 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 11069\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40730,"size_decoded":11362,"mime_type":"text/css","magic":"ASCII text, with very long lines (13584)","md5":"3bf4b8222b8594f93d93c3f27ce2b97e","sha1":"88f1e1c046a53faa28ab16eccabca8f36b211e59","sha256":"5f4d2714c451c58d11295be197bc38b7b46507179377d6970a32549cf16d08c9","sha512":"f3a2ee73af8e16d7ea52366ed737338103ee330303828acec82e837ed52a631f95aba79679bd6650297fa7b01c9f0238315ac2806f6f555438f16d5a101a85a6","ssdeep":"768:Hsx05xbe824OJ3Cr2PnlKp94z6l07AhR0umCeVBjE3y8:HsaioOEClKp9U7AMIePEC8","tlshash":"5b03f8ca8f693c6ddfc2094a66cd25cb411c67471c320889a91eb7c949db4ee7bf016e","first_seen":"2025-08-03T23:22:09.822217Z","last_seen":"2026-10-15T05:03:38.621485Z","times_seen":11,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7927.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.896Z","timestamp":1792040190896,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7927.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:04:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7295\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24101,"size_decoded":7587,"mime_type":"text/css","magic":"ASCII text, with very long lines (13496)","md5":"9eb604e33571768810b2bb7ce32ee4ab","sha1":"0a75ad6e73b2c5dccd5ae0ec78c7860299d9227f","sha256":"2dbae5758abc2df828c1450e57a19a51321bd566cabcd73a93d4282077f96f33","sha512":"0157dc685cc7100614c751fa9bac544bc26833d05229bcd4c46f2cedb4ab943be0261a5a090367fb5a5a55d41311eba397334ff30b167e29e925969800923054","ssdeep":"384:M5i7rXExtw4b5/szIwQqJ5BevyHBJ9Kph68ZTcjWQuhUt3NJvSpmWbE8JzfiBYqs:M5i72wQ59Sv9KiUQuC5S0GJze8m95BUl","tlshash":"64b2d9858ee93ca9e7ca000b66df35e3411d63eb2862099e584cfbc5496d4cd3be067d","first_seen":"2025-08-03T23:22:09.897288Z","last_seen":"2026-10-15T05:03:38.619742Z","times_seen":11,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/3413.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.920Z","timestamp":1792040190920,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /3413.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:57:56 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7484\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23413,"size_decoded":7776,"mime_type":"text/css","magic":"ASCII text, with very long lines (22556)","md5":"65a4d2ee6bf7ddec31c0994406f0a381","sha1":"c0cf2994534218faeb184856f18089ee1152727b","sha256":"218145741217398d031178760cec06e9816acea7d61c8bd63687cb3eaa929ba0","sha512":"b34ad4cd19ccc525e6a2a4b52d81c91bf7c871cd6dde30bebf9648ae59799d02f15a9a61a90053bb44e725a45fbcd6daccdd9c477c30bcc9ceb9bac3fe932dae","ssdeep":"384:pvdjQU9nkoYkjEMe8AfvXvfUurCd90mMEtjnNHa0aKZJYC7xOOXgQg+2wf4+DnTG:pr6vXvZChthcXpN6TNIg8zskz+wz","tlshash":"bfb2d8decea97c4eebd4210e62cf78d7514d638b2cb22899988cf7c9453d44e26e002d","first_seen":"2025-08-03T23:22:09.77403Z","last_seen":"2026-10-15T05:03:38.615796Z","times_seen":11,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/823.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.885Z","timestamp":1792040190885,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /823.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:54:06 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 9439\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33133,"size_decoded":9731,"mime_type":"text/css","magic":"ASCII text, with very long lines (23640)","md5":"3f208e64673be734d4019f9b36955aac","sha1":"a6390c73c3f9d7d337c0173ea5cdf89d3d6ac167","sha256":"e1fe20dc7a2d6614b132f656ecd68a74223dd5447f32cf174341e5b2392e85cc","sha512":"cdd141fbd70cd3609f316bb21ddfd94f2e53334b2602ef7af9fcc7fe7c01825333da2ba20a7bdb156f84a25032eb2e77a95bf3b9bc0c3c9a822e1fb9adf9c6ab","ssdeep":"768:GLXccB//ykNF/+6DDjV+0NneO63SoTJwJTfu3yghTJhN28nc:Cpva6DvV7NneX1FwJLYDhNU","tlshash":"d7e2d8d9cf797ca9ef95810a25df54d7022d379b287120ae908cb7c88e6e48e37d056c","first_seen":"2025-08-03T23:22:09.766417Z","last_seen":"2026-10-15T05:03:38.62577Z","times_seen":11,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7459.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.910Z","timestamp":1792040190910,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7459.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:03:16 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 9938\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31690,"size_decoded":10230,"mime_type":"text/css","magic":"ASCII text, with very long lines (7020)","md5":"e335b7cb9f66d07937718e5e954a2926","sha1":"ca56fa96aa81673eba50eeed258ce46edddf5492","sha256":"66085d948ae9e910bde8bac38d48b90f87a63874f99f6b5503c83ea1819eeedd","sha512":"5e0f5eeb19ed1dfe370495942eb2593d32d6a04c615e0ec10005cf18e827bf8cc7f54105dc8d544da440b5f5eb4f12b7fb728ecbfd95146decd600947f677289","ssdeep":"768:pTKp94z6l07AhR0umCeVBVavAYThlbEzOiTFx:pTKp9U7AMIexAAYNlSOi","tlshash":"9ae2f985ce963c49dfca0a0966ce21cb026d6b4b587315cd951eb7c40aad8ad3bf017f","first_seen":"2025-08-03T23:22:09.857176Z","last_seen":"2026-10-15T05:03:38.646706Z","times_seen":11,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6113.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.915Z","timestamp":1792040190915,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6113.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:58:39 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7236\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22391,"size_decoded":7528,"mime_type":"text/css","magic":"ASCII text, with very long lines (8412)","md5":"fa8fab5d480755253b8ec0b1f7bb732e","sha1":"15acb59eddc4cf9fb915a80c224dc2329c4fb0ef","sha256":"128694a445a050b8f8eefd64d7b287c480dcd83ee49b42c97a84e75c5929c4f9","sha512":"cf81bd985e8c40484454f8389b3a0e85eed6a236c8b068129571d2acecba2d95ed16c6390779a20179cb2942bd6e3a259bb95e6095e1b7585d98a6ccd8684f14","ssdeep":"384:n/TOYWEeg8W0DkOAkOdDkOAkOdUcySn+gFt8lfke1mqbvrViFY402nsVC933y7+r:r0kOAkOBkOAkOPsfkozrZb7VYya2RSgS","tlshash":"d4a2e6ca8c267908eb2607469bcf26d6012ceb8319711dfff2d477994b666cd23d012e","first_seen":"2025-08-03T23:22:09.758779Z","last_seen":"2026-10-15T05:03:38.661906Z","times_seen":11,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/2732.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.880Z","timestamp":1792040190880,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /2732.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:54:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 8373\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23947,"size_decoded":8665,"mime_type":"text/css","magic":"ASCII text, with very long lines (13792)","md5":"f6a5b574955f5a2ff53f5df1b0950fa8","sha1":"69e4031e03da81d19bc81faac0916539d6e387b8","sha256":"fe7fd4f2db5bd2ed199ca095118c8997cf1c45e479ac0e34f172ed08b4c44183","sha512":"4a0ec3553d3146abf2a4b1411e1fb32d6d2567e7b3f11a33794596b7a81af34ec7248cd363f3fe85cf13185e1416c631e7b9400bef6a51a71740bf502d339058","ssdeep":"384:+CQUMTv22Nwnv6vvr+MzaMYU1ZSTNvKXvBMeweFUeM11z0rTOtK343F6VF4rDZmO:/A+2N/niMmlUbSoXv3FUeM11z0rTOtKw","tlshash":"4eb23acb8f3a3e29d7854a06a6cea5ca101d93831c22049e9a8cf7cd499d5dd3bd453e","first_seen":"2025-08-03T23:22:09.755863Z","last_seen":"2026-10-15T05:03:38.658434Z","times_seen":11,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8005.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.905Z","timestamp":1792040190905,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8005.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:03 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6897\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24215,"size_decoded":7189,"mime_type":"text/css","magic":"ASCII text, with very long lines (23692)","md5":"686c098a18e6b8c3069f1f67926c0e17","sha1":"f303509e22995311589956ca04b7d8e04c57f17b","sha256":"901fa9164c7f985996ba6ff64f3a9b79df8d43b6cb3728f74048dc3e78fa3db8","sha512":"5686e5d07266e98eddb052865bcb4eb6adec211d3c0556681ed775217db05aa508ca711ca2ac322333e2d4c871ab142f09a25b3fa5d2901e4361532ed36c49eb","ssdeep":"384:PZ3qn3cFPFHwG3rsPfv6wNk36bPQFNx/OG7Yyh7gaNYptJqJYH3NUNo5IuitPZgt:0vOwyh7Uw9NoWhhgA2E21L2hWQI9","tlshash":"dfb2b5cecfaa3d94ffc5090a52ce64d6002d97972c72049d994ef7c8559e09e3be026b","first_seen":"2025-08-03T23:22:09.795569Z","last_seen":"2026-10-15T05:03:38.660315Z","times_seen":11,"resource_available":true,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8838.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.917Z","timestamp":1792040190917,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8838.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:44 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1950\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1950,"size_decoded":2197,"mime_type":"text/css","magic":"ASCII text, with very long lines (1292)","md5":"6d9c0d68a51d016ca0779ec13f0ac0fc","sha1":"a835705d2fb0bfe978721ca1a562f9413b28231f","sha256":"39be0dbde7a4ac4e07d90d8929d26fbbc1f4e88f79eea7c604f4ce66c6a14223","sha512":"6c6515233bfdeff6bc60cf8f5019267240a2c1aab0dabab5320c2ceffae8f1e499a3328322536fc4a1f6565e8a243d6730786a65d9d68a7f657c65cf66df8486","ssdeep":"","tlshash":"f84196eec8a5746ac9174e0d73ce02db00696fa369734183791452c684696ad33e1a27","first_seen":"2025-08-03T23:22:09.789645Z","last_seen":"2026-10-15T05:03:38.623856Z","times_seen":11,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/9295.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.924Z","timestamp":1792040190924,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /9295.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:52 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 12420\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42697,"size_decoded":12713,"mime_type":"text/css","magic":"ASCII text, with very long lines (20800)","md5":"93f52ee954f935345aaee57529bccb8d","sha1":"2058bf530848acc0ab2e851407233ab8256d4551","sha256":"2d076112b3d175548506469ed27344f8dd5c9e0ddd8bf957ba7557e6d813fc90","sha512":"00614fbca46c4b815c023e858a9c313c1332db6528361805c70aeb3edad9f6d0fb8bdb3aa19a47b4f9b4a707adda59500424dd54724ab4064322b113206f2793","ssdeep":"768:NmXRPj0kOAkOBkOAkOPsfkozrZb72ChzAHvvxvTCVhfUkUKVM5p39m7fUhvfR5RY:NmjCsdbCEoZTCb8kS5gKR5RrFqT","tlshash":"2a132bcece193d09eb56064527cf22d7112da787183219efe58877c58bae5cd67e002e","first_seen":"2025-08-03T23:22:09.77986Z","last_seen":"2026-10-15T05:03:38.64773Z","times_seen":11,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseDisplay-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.847Z","timestamp":1792040190847,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseDisplay-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseDisplay-Regular.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.849Z","timestamp":1792040190849,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseDisplay-Regular.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/3598.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.891Z","timestamp":1792040190891,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /3598.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:58:08 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2833\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2833,"size_decoded":3080,"mime_type":"text/css","magic":"ASCII text, with very long lines (2796)","md5":"5e22c71c31f6b34f09d9088990d1649a","sha1":"437dcc6226ae64b333203d37c62de1179c299573","sha256":"0ac032b64327747dbe58162659c768a14a7b14c84a4c5354e62e2a575b3f3e80","sha512":"bb4b457d2844b48ce995baafc032ebce039d4488814a4214f3678fd53987a35c1bbfd699ac9ce33d65044c99c437a99cee2db0873d10cf4cda8a4b1eeb4c9232","ssdeep":"","tlshash":"e051d2c85704893e5546adeca39c6f9be561b54006320df33a5713b616dbace73bb0c2","first_seen":"2024-10-12T13:57:36.259626Z","last_seen":"2026-10-15T05:03:38.612789Z","times_seen":16,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6965.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.892Z","timestamp":1792040190892,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6965.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:44 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3869\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3869,"size_decoded":4116,"mime_type":"text/css","magic":"ASCII text, with very long lines (3008)","md5":"2b6108f7477b2e446879f94f2c7182e7","sha1":"d3a5883731e8a81f4ffb43aefc9230a613f4f256","sha256":"8c198e700a95a0dfbdeb9f99f72cce58bf25c171672caaa2d9127820566f6d63","sha512":"20602b512f2d1ee71be227141c375c44ddc8a62b15f3cb9e0a30c2cb80d4c5dbdc58fe3500d9ff6c3cd582f4e3aec1d4414f8102738813d179ede6b1d9aa84ea","ssdeep":"","tlshash":"1881ea9b44612f09ca07d80197ff7193815aee5b285122cd980b7fd687ff9c12af419d","first_seen":"2024-10-12T13:57:36.261958Z","last_seen":"2026-10-15T05:03:38.640335Z","times_seen":16,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseText-Regular.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.864Z","timestamp":1792040190864,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseText-Regular.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/4201.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.882Z","timestamp":1792040190882,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /4201.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:58:18 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 13251\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42041,"size_decoded":13544,"mime_type":"text/css","magic":"ASCII text, with very long lines (13112)","md5":"10a14c5aada8a744fd0f5609346602fb","sha1":"a72fbe195fcb47c25dd7b267bf0832ed935368d5","sha256":"a8792091960815794b2a49721f5f124c8cde9ea4f9f885bf77f941b60e23e39f","sha512":"c6c4cbe67db084990fd225cf064880d83bcf5e22b9f029447e9685789be66a49cc50eac8a0a9b3f68c945d3ad0143572c973834402d1de8e562a49d9e73fc508","ssdeep":"768:MnU83pYya2RSgJn/BuyXHEh/xmYUclVd7ZGcwdXce22b2LxMudWdvthROYg2NUgQ:MnU83pYya2RVJn/BJXkh/xlUWDYXc1Ll","tlshash":"b91319cedd6d3d59efd40512a6cf31eb015ca38b1872198d664cbbc84da958e37e802e","first_seen":"2025-08-03T23:22:09.860486Z","last_seen":"2026-10-15T05:03:38.66517Z","times_seen":11,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7219.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.903Z","timestamp":1792040190903,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7219.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:51 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4940\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":15964,"size_decoded":5232,"mime_type":"text/css","magic":"ASCII text, with very long lines (13000)","md5":"53290e107c669402a2ee95cb5ecaaf9f","sha1":"a01ed006daab0f41bd448800103bade861fba54c","sha256":"30644fa4dcb84f48bb34840fb16ccca6fe19f77fac4256c09c18ccafa88b5e17","sha512":"274fd28aeb783bf690d71a17c1139e5218b78f9daac46ca06bb195220d65cc24929f636b418724786987fe8444ac135fbb0d3275b8e125a0bece2cd0428e6425","ssdeep":"384:OAJuY6UQTwE67HBL2I2zmtXTGtjU/py1Tz1smtg2xxcMEbc2uuH:Oq1GtaI1G2xWcQ","tlshash":"9262c8c88e556c68db86a4cc5bdd7adb810e270208311cae6d0e73e506eb5cf73f1199","first_seen":"2025-08-03T23:22:09.853565Z","last_seen":"2026-10-15T05:03:38.665976Z","times_seen":11,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseSans-Regular.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.860Z","timestamp":1792040190860,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseSans-Regular.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7561.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.875Z","timestamp":1792040190875,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7561.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:03:32 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6184\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6184,"size_decoded":6431,"mime_type":"text/css","magic":"ASCII text, with very long lines (6112)","md5":"59d1bd9a14a050662c482f54893d823a","sha1":"a41742b0d6f725d59e860a2957b83cdcadffd04b","sha256":"c4021e48abefbb93b72cf350cb599c548195fcdaedbd8cd7bad4da14e734a26a","sha512":"b57f47e5a0a299300bbb70de917437016f4a92e71b5b86ba5f34a2ea11d86f3c4ed8678ad953fe0c38de7e0cf195a2e6e236acbb249ec967eb06df852569da75","ssdeep":"192:Wgmnp52J6v0GG8iUbr6B2tzEkGkb/CIhq1yNPL7rJq:E2gvB2+ew9GkrCCfvrJq","tlshash":"79d1a8da9f262cd4ffe0440b56cd66cb112d678b1831315a464cfbc8997948abfd0e2e","first_seen":"2024-10-12T13:57:36.248175Z","last_seen":"2026-10-15T05:03:38.645068Z","times_seen":16,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6337.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.908Z","timestamp":1792040190908,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6337.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:04 GMT\r\naccept-ranges: bytes\r\ncontent-length: 761\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":761,"size_decoded":1007,"mime_type":"text/css","magic":"ASCII text, with very long lines (580)","md5":"b414841d6afe1f52c213449a9aa9b618","sha1":"6f2241c189e5f56354ba461959ad2b95dd2fdb26","sha256":"667fbbbfc4436d883a52a11faa154b0e3a93e1f37d9b9a0022c9c919b22851d9","sha512":"5e28a5754004f0537b6a393be75c129bb49f0ec50e7df4e3f6eac43bf09e115ce28f9aed074169f3103977b9bfbc5a623ce7f037e25a0e1f967442ff1dba1489","ssdeep":"","tlshash":"bd0125fe5e932cb8cc591c4e068c647507a831f7b4619dedf0841a9f58295f1e491d2c","first_seen":"2025-08-03T23:22:09.875645Z","last_seen":"2026-10-15T05:03:38.639088Z","times_seen":11,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseIcons-1683141327044.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.851Z","timestamp":1792040190851,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseIcons-1683141327044.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/favicon.ico","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:31.484Z","timestamp":1792040191484,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseDisplay-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:31.278Z","timestamp":1792040191278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseDisplay-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/popup.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/popup.js","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.844Z","timestamp":1792040190844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /popup.js HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6123.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.868Z","timestamp":1792040190868,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6123.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:58:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 11656\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":41161,"size_decoded":11949,"mime_type":"text/css","magic":"ASCII text, with very long lines (15608)","md5":"5ed98a468339e882005a72bf256c05f4","sha1":"10cf2469cdf527f377c9a8b496289ff9c4293ec0","sha256":"a5f28f213ee3fda9090e3afb9783340bd38a3d71d13dc3cf9c5ce0bf3f9e43a8","sha512":"3331a78eb829caa75033169bda0a684fd4d6c6e7f9f19a5bbcabefefe0a2aa47188de103188ee00965ec359dd3271c10f33f9d4dbaf1f60141472ae9867c5a76","ssdeep":"768:CpjNYQS/zuObjxx05xbe824yjbv2vDvXvMtK7E8w1l:JQS7dxaioyjL0D/Md1l","tlshash":"d603d5cade7d3c55efc5050aaade65da401c67972c320488d90cf7cc4ca9499bfe522e","first_seen":"2025-08-03T23:22:09.835949Z","last_seen":"2026-10-15T05:03:38.659769Z","times_seen":11,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6823.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.899Z","timestamp":1792040190899,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6823.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:30 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3951\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":10817,"size_decoded":4243,"mime_type":"text/css","magic":"ASCII text, with very long lines (10740)","md5":"ead9a18bff1ffcee3b587bc183117d6f","sha1":"496f6385f41bb649ab486e064f46427a7cb6d0fc","sha256":"a6ade12fef0845becf4d9dbc085345f71fcf01c28ce2014c1e05807f4c6692ce","sha512":"e17ef5aa6934e3f8adba30b75a10e6293678d6a7e172ab108cfec6bd1b327cdb338030abbfe60e39fe0c2b2d42bde8adf8311235565ee2ae243244c418b4b762","ssdeep":"192:icZ55jq5Kc5ucjr5m5Pw+JF1ZDTsPQWc+ww6wESpnTDJp+/6rmOre5j:fZ/e7ucjduPzvjDTsRc+ww6w/pnTDk6m","tlshash":"1d22e7ddcd6d7c94eb84454aa9de20cb126d3f972c322a9dc05ef6c88add0852bd427c","first_seen":"2024-10-12T13:57:36.274841Z","last_seen":"2026-10-15T05:03:38.641578Z","times_seen":17,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6707.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.929Z","timestamp":1792040190929,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6707.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:23 GMT\r\naccept-ranges: bytes\r\ncontent-length: 5404\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5404,"size_decoded":5651,"mime_type":"text/css","magic":"ASCII text, with very long lines (5304)","md5":"57ac7a69c32ee3a945650dec60039f4d","sha1":"9c41ed3405ea9659e8ebf50a6d3d92f4fb67bd08","sha256":"b09ee97f102c4c7f6ab8a1d951fb633610d935c55f42d5ba73ee0fefc8b3270a","sha512":"8c5495e23cb39b89ead5a2e7221279cabce7459ba426a1be04116e1b22f43f010eaafe8e0565e15987bdcd3143d92e8cdca96c04d15bcd8f25bd16a538df97ad","ssdeep":"96:Xi+rOUEqYrWsBaiw7sQUkPT+DMFXaTt/8BbQmGiPKLV+8DQg:y5vrisBaissC79aTt/8ZPG6CV+8D9","tlshash":"7bb1b798de3a3d99ffd8050662cd74e6802c6fd73c63458ca84bbac4061c5ce76e426e","first_seen":"2025-08-03T23:22:09.825585Z","last_seen":"2026-10-15T05:03:38.630669Z","times_seen":11,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8136.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.932Z","timestamp":1792040190932,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8136.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4986\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12834,"size_decoded":5278,"mime_type":"text/css","magic":"ASCII text, with very long lines (8160)","md5":"c73120582526d13f45ed267935b347a4","sha1":"331150b6c64fdaeb84cabe44662be62fdc364a42","sha256":"f16da5bb176a28afe5734595679a528dbfbadd45f95a31fbb0894f75c5714260","sha512":"8261c12959d71d4ee390d317178a739a4ac65d276ed0494b9973e24a5c378a399cd1676becef8bca811926976ea5f06c82374368d80502be92b101a716e60ec1","ssdeep":"384:vu8FHOwc2QaSX8Mg0Ndfv2KJtnxIN2hHi497lkf6oO0yAO:NmXRPPv9/xcQRHkfbxVO","tlshash":"1342fad98e183f99ff86040637eeb9db411ea7c70c61155e584ab7c44bba48a37e012e","first_seen":"2025-08-03T23:22:09.900033Z","last_seen":"2026-10-15T05:03:38.663012Z","times_seen":11,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/wvideo.mp4","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:31.234Z","timestamp":1792040191234,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /wvideo.mp4 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\ncache-control: public, max-age=2592000\r\nexpires: Sat, 14 Nov 2026 04:56:30 GMT\r\ncontent-type: video/mp4\r\nlast-modified: Tue, 13 Oct 2026 09:10:08 GMT\r\ncontent-range: bytes 0-13346671/13346672\r\ncontent-length: 13346672\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":null,"data":{"size":13346672,"size_decoded":13346943,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"04dc81cd9f23b96ae950f831e1739919","sha1":"52b608c61fc16eedc4845bd07322fa9218631fe2","sha256":"d7694b7fdc71846040ef9241cbe223231a597e3e14f8a4a038f898f4644ab8e6","sha512":"4c81bb8034519dec3ef5ccdc2824a36904e019269af7100168afb8fbd73fd8e49e78228bf76c032000f11631a43d5bd6b7493375726cb4ae0b178df936b0fb54","ssdeep":"24576:FsBmG51jWqR7v78t+cmhWQ3mCVrKAip5JaM9q/:2PJ8t+c6v3memjJaM9q/","tlshash":"a925122e9cd45110ffb5f97ca480d8a6d6c8a280dc9ec7cbb81e51484bb41e56faf136","first_seen":"2025-09-26T11:40:39.591415Z","last_seen":"2026-10-15T05:03:38.579469Z","times_seen":19,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":371,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseMono-Regular.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.857Z","timestamp":1792040190857,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseMono-Regular.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/popup.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.866Z","timestamp":1792040190866,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /popup.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:06:19 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 72841\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":308716,"size_decoded":73134,"mime_type":"text/css","magic":"ASCII text, with very long lines (20592)","md5":"c49a8ea75c837eb5826163ec376a1487","sha1":"5c5fc86e9071f80a7d8390513442f46c9b0348cb","sha256":"7d7055a2e5ea84b7f402a9304da8bcaf54118738f033232b20238fbb778b8823","sha512":"2d0d98ed765989ca375eca4f7f442a1fac8c943328992385b7edee5355ece19f1a3a15f793d0487465d811c3084cbc4520396aa2d61c065106d94d7bfdb1f7c3","ssdeep":"6144:50CnfWKa37s/L5wFujj1zoU2a26Ix4LfHiPLBhGD9:508fW1Az5wEjpzN04rHiPe","tlshash":"d664289a5e31bd3ceb7549ae62dd6bcf000d3b471c2104cca50577864ecbaab96f122d","first_seen":"2026-10-15T04:54:48.399669Z","last_seen":"2026-10-15T05:03:38.628447Z","times_seen":4,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8071.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.877Z","timestamp":1792040190877,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8071.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:10 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 14434\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":50385,"size_decoded":14727,"mime_type":"text/css","magic":"ASCII text, with very long lines (30524)","md5":"89cada5235312c7d2682fed693fd1062","sha1":"609659535ddf047f90abb99e2aed5b3ceae6a7f6","sha256":"6281bc60ea3829657233fdcf5bdb7b0328acc0a52250ad416194afc17519cd5f","sha512":"30e3b0ffb99d0cc7909e9c5296fac2da46b2671d99ce461be5d326b1430c10deef8de5879dd94af4eb48f810e8ce8f6aeb2bcb07dafd1f45247c5590f892bceb","ssdeep":"1536:13pKKwtWxrUKNbMzyE/bSzeDq5lkzvV08inI9ZXLVancr:1I2rUKNwz3/bSzeDq5lkzvV08ino4q","tlshash":"ae33e8ce8e6d7c29eb85494b63de66c7410c67932c321d99990db7c889ab0de37e007d","first_seen":"2025-08-03T23:22:09.845174Z","last_seen":"2026-10-15T05:03:38.663762Z","times_seen":11,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/9310.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.901Z","timestamp":1792040190901,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /9310.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10218\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":10218,"size_decoded":10466,"mime_type":"text/css","magic":"ASCII text, with very long lines (7344)","md5":"15d419b5f2b4008bfdb17748e800c391","sha1":"2f58c7a401812ecd82bdc2f861e11430eb8dbe85","sha256":"21a4399fd91c6ed5b427db6331b69fe8463d16dbc7b33cf4f80230d92eafa5af","sha512":"2b4a3ab4c7278019f843f7158abe095c2ec437bfa19967e7377a4129c79cb162270fe3ff430c2b4e8036180909ce8a4b431cb3aeb9f74a346152bad42327e51f","ssdeep":"192:OXg9JZUi75TWUA7N/m+zHJ3hnytKHTF7Hho2BuR:59JZZtTWR79mIp3hnlHTFLiouR","tlshash":"d62293c88f285c3cef8559e993cc2bd7906c674108320caa690f67e6469f6ca77f61c5","first_seen":"2024-10-12T13:57:36.27346Z","last_seen":"2026-10-15T05:03:38.645877Z","times_seen":17,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6826.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.897Z","timestamp":1792040190897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6826.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10218\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":10218,"size_decoded":10466,"mime_type":"text/css","magic":"ASCII text, with very long lines (7344)","md5":"5ddec9f4221d02e10f4844a806e8125a","sha1":"34075115a8507fdea6d11c2c2457c1092cf1464c","sha256":"79c32fbb6d8e87911a5e6b8fe7dff355a2952dd0edfa839b09fb576549b8d401","sha512":"d4281e466078bed49bf9067243d574b6817cef417657ec43d18e06d98cdc2be84a3d21c7754d5169d7dc9e5daa09e2e6034a850b47950b30144578bada346548","ssdeep":"192:OXg9JZUi75TWUA7N/m+zHJ3hnytKHTF7Hho2BuY:59JZZtTWR79mIp3hnlHTFLiouY","tlshash":"9622a3c88f285c3def8559e893cc2bd7906c674108320caa690f67e6429f6ca77f60c5","first_seen":"2024-10-12T13:57:36.270159Z","last_seen":"2026-10-15T05:03:38.622746Z","times_seen":17,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/233.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.918Z","timestamp":1792040190918,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /233.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:53:31 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6984\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20474,"size_decoded":7276,"mime_type":"text/css","magic":"ASCII text, with very long lines (15460)","md5":"f5d88e05c68aba6ad1ab05a5a3093e82","sha1":"30d725b3b6e28cdcac9ad9230d94c2cc152b1331","sha256":"4e743cd853fad62dc86b30d31f7fc04a6c92f4bb875f76ecce49063f4f3c3d0c","sha512":"da96ffd8ef8f63aefea264ab6f7434b5ded0e396908ed76c306bbfc207ed1d63b3844c61ed8e96831503b0e3bee74a3461c0aefa6ee1cfc6cdd376384a2c73b6","ssdeep":"384:vu8FHOwc2QaSX8Mg0a4XUNenqAG91pbD1tn39P3PkmBBRh4NHQcnVPcaHF8S445h:NmXRPp+AsJtPfMNHQcV9l8aC+n88t","tlshash":"5492f8cacf697c19dfc245067ade75db001e678b1c72058c5909bbc189ed98d7ee023a","first_seen":"2025-08-03T23:22:09.830135Z","last_seen":"2026-10-15T05:03:38.61803Z","times_seen":11,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/667.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.922Z","timestamp":1792040190922,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /667.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:53:47 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4755\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13584,"size_decoded":5047,"mime_type":"text/css","magic":"ASCII text, with very long lines (8736)","md5":"24a1e7549c21485b13e17d12fd960fda","sha1":"7f180ea5417cbc664e8f5c1a0c6e1f3df9e1bb27","sha256":"2fa22046ed972b24fb200a46571c555796ee6a4db0313e81e8c10048c345ca86","sha512":"5197f5e7c06422082883f1b47011fbad98a6b32e1133ccba2e8edc9e49f31452cad9e6f61ccc48778937723c55411f2a66feab9787d8884582360c2228de2ed1","ssdeep":"384:afdMR/OXAaukyg291ve3iW30Lg9t/etBl8K3BL8n5:aVGmyiv5erl8K3BLW","tlshash":"7c52d8899e9d3c54efc5150b61ce15e3122d178b283229adea5cbbc54c6d4cd7fe021e","first_seen":"2024-10-12T13:57:36.302731Z","last_seen":"2026-10-15T05:03:38.607752Z","times_seen":17,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/1233.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.930Z","timestamp":1792040190930,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /1233.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:54:17 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6428\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":17904,"size_decoded":6720,"mime_type":"text/css","magic":"ASCII text, with very long lines (12904)","md5":"b4189fb48ed3163cbe985b101de6c4a1","sha1":"06a20516dfc338d3f7ee165a3d7ba97541b0d680","sha256":"d790d998996c9ffabba469c378e21a5541baf994ea02b12638b6af00c8216ab9","sha512":"7e439165d2c90505fb5a6e60981af51adfa435a2974d1c2e792b7b7af948aee160f97231b747c73353d77de7fd920ef80c88dc23bec8a36e74c7a3238cfde5b0","ssdeep":"384:vu8FHOwc2QaSX8Mg0gnFPltiv2LjuzEVLtChBZWm4is0rDE0xo8QHI0/O163sab:NmXRPgByv49Vl4s0rhG8QHI0/O168ab","tlshash":"a682f8ce8f787d54eb86510637de35c7003da7872833168d9a0af7c48a9a18a77e013b","first_seen":"2025-08-03T23:22:09.819313Z","last_seen":"2026-10-15T05:03:38.659076Z","times_seen":11,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/fonts/CoinbaseMono-Medium.woff2","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.853Z","timestamp":1792040190853,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /fonts/CoinbaseMono-Medium.woff2 HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-10-15T05:18:29.396433Z","times_seen":58231,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/8494.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.884Z","timestamp":1792040190884,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /8494.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 09:05:30 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 15944\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":60402,"size_decoded":16237,"mime_type":"text/css","magic":"ASCII text, with very long lines (10408)","md5":"e2fd9c25a457926fe72242d34268e351","sha1":"e83a2a0e17ac86eeb0c783e7b7efd884eb1bc0cf","sha256":"b82abf32e1a665c2f15fd9c3d236ad34038366b95b15138fd327ee930dc522b8","sha512":"fd0da0db3cd81dcaebfaacd43fda93c247433641b5c36f736356985559ac5bd66aa70dea78688a7e09252a078f8d05f1d9dc096479118eb185159d5697ad59d2","ssdeep":"1536:rCsdbMCRehRWVCKV2c11GszBxXEVD8pLqFNjiEl3rqTkUkSSU9CLsOLOl0Axh3rn:r7b4R0r11ZBxXEVD8pGPrqTkUkgkOdhn","tlshash":"5f433acd8e593c58eb86058867ce26d3012ca7871c331def698977d506ea9ce37e012e","first_seen":"2025-08-03T23:22:09.839378Z","last_seen":"2026-10-15T05:03:38.653205Z","times_seen":11,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/7280.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.911Z","timestamp":1792040190911,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /7280.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:59 GMT\r\naccept-ranges: bytes\r\ncontent-length: 5463\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5463,"size_decoded":5710,"mime_type":"text/css","magic":"ASCII text, with very long lines (5000)","md5":"2d7795b201e9195e31005355cdc5f74e","sha1":"7cdd53b50fcaac5fba5524dbb3cd3c2802729e24","sha256":"1eab3e339eb21129aee3a9c4ce431c88248e96cf4cc271d8224c8f1bec9685dc","sha512":"1859a34535ef7ff9d991e49a043ab3107775be5848a1428bac02451f0cae2862dabe1084b699e4827395ffab6a3a6cc5506688634e3a63230481c6625d4dc938","ssdeep":"96:AdvWtIr7X97ItPY5njd5HRZMT0FIfcuLM8YIJQVjBvO+eZrhKl862rJYHnN:eWtIftctPY5jd5xCT4IfcuVJQhBW7hKJ","tlshash":"d0b1f787ce803e99e7c64a0653df34db826ee3472c22119e958dbbc6436654d3fe112e","first_seen":"2024-10-12T13:57:36.282535Z","last_seen":"2026-10-15T05:03:38.656226Z","times_seen":16,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"coinbasextensions.com.expresscouriers.net/6458.css","fqdn":"coinbasextensions.com.expresscouriers.net","domain":"expresscouriers.net","tld":"net"},"ip":{"addr":"79.133.41.203","port":443,"asn":44066,"as":"firstcolo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://coinbasextensions.com.expresscouriers.net/","date":"2026-10-15T04:56:30.913Z","timestamp":1792040190913,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinbasextensions.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 13 Oct 2026 18:44:26 GMT","end":"Mon, 11 Jan 2027 18:44:25 GMT"},"fingerprint":{"sha1":"8E:5A:F0:18:CD:34:04:EA:59:57:52:76:E8:D4:32:25:32:18:CE:3F","sha256":"6E:35:62:41:0A:6C:48:46:85:77:80:AD:2C:8E:06:4C:75:64:07:9A:D7:E8:E1:4D:57:EF:60:5E:5C:D7:1F:2C"}}},"request":{"raw":"GET /6458.css HTTP/1.1\r\nHost: coinbasextensions.com.expresscouriers.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbasextensions.com.expresscouriers.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 15 Oct 2027 04:56:30 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 13 Oct 2026 08:59:12 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 5324\r\ndate: Thu, 15 Oct 2026 04:56:30 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":15859,"size_decoded":5616,"mime_type":"text/css","magic":"ASCII text, with very long lines (15788)","md5":"0499b50a20c45574baf75b1f8e34221b","sha1":"2b2ccf8ee02ecabe1985cb21670bc9c2806181bc","sha256":"84d94c9e83c7e843fd5cfc82fdd8258aee8a7f2aef7f0be2798fb134cccb2709","sha512":"0e9980e3483b1884535951b86f2128f720545122590a66ac3d6c771df43d02732896172e1afbc4adf20d4e5d8e46553ca6fb515529e2737c9f3984da8d649b32","ssdeep":"384:806hNdBKOr9UvvTvY9IiUKW8JBPgkNsTafnqZBA4RwdiMi2/t:RUNWvTv+NszBA4Rwdi32/t","tlshash":"3362f8ae9e6c3c49e7c94805a1cf71d6c26d038b3c2119ad8d8cfbc5c4ae5ca36e4569","first_seen":"2025-08-03T23:22:09.867012Z","last_seen":"2026-10-15T05:03:38.654162Z","times_seen":11,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-15","alert":"Sinkholed","trigger":"coinbasextensions.com.expresscouriers.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}