{"report_id":"7925864d-e375-44a6-92c8-2576930e36ba","version":0,"status":"done","tags":[],"date":"2026-06-08T10:11:45Z","url":{"schema":"http","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":0,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"final":{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"title":"encrypted-exodus.com","dom":{"size":16612,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (520)","md5":"3d4159a72d1da2b672cdffc22f183dbe","sha1":"fb2313091f66b2fe848b0c97ff4d407a29176fef","sha256":"0a5d80c350acfd9ae9113cef9100de3150e9e65ebd10fdcabd2b4013a3c86d83","sha512":"2d369f7455d16c85229c20e8c79bf4d80fe9fa648c5d1b6c0fd9abd0138e48975bbee5084c8a3950528cc9256c19f2f0ef66252adcbff647498e42c5c21cac1c","ssdeep":"192:IR8pKfsTxcYoHSiF5IzA5GYJshafKIxOJdt+Bet2n0llgeWHbOSP0QYoHsfOBro4:IexcYoHSiF5unoBo2lTH6cnYoHsfO2/G","tlshash":"6872c9476fe31509f11bc0a9df9aa35932289107960fcd6cf9ec76a8df4819421a3bdc","dom_hash":"domhash8fd63b18110237215a1c4a9179a45154","first_seen":"2026-06-08T10:11:49.062142Z","last_seen":"2026-06-08T10:11:49.062142Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":0,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T10:11:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"obseu.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"yfdpco1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"euob.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"encrypted-exodus.com","ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"domain_registered":"2025-12-23","domain_rank":0,"first_seen":"2026-06-08T10:11:46.015938Z","last_seen":"2026-06-08T10:11:46.015938Z","alert_count":9,"request_count":3,"received_data":17644,"sent_data":1951,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}]},{"fqdn":"yfdpco1.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-03-20","domain_rank":2753637,"first_seen":"2025-07-30T06:43:08.0267Z","last_seen":"2026-06-01T19:50:29.401268Z","alert_count":1,"request_count":1,"received_data":0,"sent_data":772,"comment":"","tags":null,"fingerprints":null},{"fqdn":"euob.northwavepoint.com","ip":{"addr":"13.249.8.68","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2026-01-28","domain_rank":0,"first_seen":"2026-04-16T09:06:21.216693Z","last_seen":"2026-06-04T12:20:08.662027Z","alert_count":1,"request_count":1,"received_data":137466,"sent_data":500,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}]},{"fqdn":"obseu.northwavepoint.com","ip":{"addr":"54.75.69.192","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2026-01-28","domain_rank":0,"first_seen":"2026-04-16T09:06:21.210986Z","last_seen":"2026-06-04T12:20:08.815079Z","alert_count":4,"request_count":4,"received_data":5583,"sent_data":4353,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js","fqdn":"euob.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"13.249.8.68","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1bb3ab22ed57318ee11d270c1c3f59ce","sha1":"d88ea0564fd58af764b741b0a50e78b4523e7103","sha256":"93c03215b2f3bdddd55ce066691d5fba626924cb98f3eaab8ce8e177d030599a","sha512":"8cd9d5fb4c2cc64831f03cb4c770788b233770dd82edf5d4b5c1670b6c7d8d5d741214857b702f1ed6b06bea259f3149b9a289805770bbdc8d5228c2c0c66457","ssdeep":"1536:sD+qPQb5SEwvAu5DWeBPU4HLonMbVGhe3qM87961QCixUcnYtB/l7PsXWIo6MWmN:sCqP/AuZWyjqu1QCtveXolS0nInWBypO","tlshash":"8bd3d7ddf2e27025039320a5017f411ae27b1e553c4b8290d5bae9d4ac7ce8e957bfac","size":136943,"data":"","first_seen":"2026-06-01T21:19:08.293855Z","last_seen":"2026-06-14T18:29:01.620025Z","times_seen":3492,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"b326b5062b2f0e69046810717534cb09","sha1":"5ffe533b830f08a0326348a9160afafc8ada44db","sha256":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","sha512":"9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de","ssdeep":"","tlshash":"5430000000000000000000000000300c00000000000000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-08-03T02:49:54.712563Z","times_seen":427781,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"889ca9e2c79a3ce7aaadbcdfd0ce4ef5","sha1":"b05c2c051bae71f80cb8c289e5a42d4f96d323fa","sha256":"6477acf082d26199b6ce8346b93149b1b999233d9fe76b0340ebf43317cf98f8","sha512":"122a494d50a5e8077cdda40e8d6edb442bb9d89fff078852aad7f84fe24f1c58fe693f0388ca6c9453d1b33036da0b9c4e9fb394a18268e254d306ffc2ca57a3","ssdeep":"","tlshash":"46a002d4b4ed8125564583390104d91cf936c934c0d5701873f0466ca6e700a53610b2","size":62,"data":"","first_seen":"2023-03-07T01:20:41Z","last_seen":"2026-08-03T02:49:54.713566Z","times_seen":396478,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"6559111e4eae643ce013ce0821e91a02","sha1":"fa1086c9aa2cb2d14f5c13bceefe21511bcdae5a","sha256":"d72255f7e5ea4dfdf9821df800356367d0bc7df07ecd103bb660018cb1e4f400","sha512":"a6e3e096076dc152b69e95709dad8925c9c2799c23ad226b9ce7b6ee78936bea7300b66c92821ea0728ce7433d4f53787f27f5e7101f97e4d882be0a461fc051","ssdeep":"","tlshash":"407000000380020020c80233a200882af228003c00030200c008888800a808002080c2","size":25,"data":"","first_seen":"2023-03-07T01:20:41Z","last_seen":"2026-08-03T02:49:54.715553Z","times_seen":396440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/382add90-9d09-42c5-bb6a-9be698023050","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"introduction_type":"","is_inline":false,"md5":"16d426426920d018c0705c821c634e17","sha1":"5f39ffe2b3638d9beef97d1e66819b6f8ad5e82e","sha256":"796a3b5c57f6b86c21cec38cfcc2c6fb25c3f20dceaa1dbda21c0bd10328aa0c","sha512":"c89345c2c89f910cc65627f15648de09ec5af99c4087c34770dc0bd8194345f77c82a5d1b3e86dd774271abcad9d44dda25091806235a0813b7fa296cac076c0","ssdeep":"","tlshash":"bf017008f53c1b58436b191376cff508e03b06487d8b607840aa88c88eb6dc710237fa","size":779,"data":"","first_seen":"2026-06-08T10:11:49.069232Z","last_seen":"2026-06-08T10:11:49.069232Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"e5d8c139688b25ef77b263d88ea99150","sha1":"7abc9c61c4966543f66d150c0155bfac575f86a7","sha256":"53e5f34ac520035c7f124076d1e68c70a85c83cf68a339fa713b872b54126148","sha512":"1cd4eb192d987ea1b21f3b553eea3881c807f8bf4a5299982675d57314a0eaa084db1722c38d02eb73178660ecb1ca3667a795a512527f843f2526dc0a99dc20","ssdeep":"","tlshash":"7440000000003000033c0000000000c0000c00000000000000000c00030000000c0000","size":7,"data":"","first_seen":"2023-03-07T01:20:41Z","last_seen":"2026-08-03T02:49:54.714589Z","times_seen":396489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Failure callback complete.","filename":"https://encrypted-exodus.com/","line_number":0,"column_number":0},{"level":"log","text":"Failure callback complete.","filename":"https://encrypted-exodus.com/","line_number":0,"column_number":0},{"level":"log","text":"map[type:null]","filename":"https://encrypted-exodus.com/","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"obseu.northwavepoint.com/ct","fqdn":"obseu.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"54.75.69.192","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:23.895Z","timestamp":1780913483895,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.northwavepoint.com","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 09 May 2026 00:00:00 GMT","end":"Fri, 07 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"81:BC:A9:21:63:E0:B6:9A:20:C7:07:EC:3A:69:03:A1:17:C1:42:A4","sha256":"02:6B:C6:85:E6:24:7C:BE:F0:52:8D:76:04:40:96:61:C7:23:C2:DA:A4:38:F5:F9:19:BB:7C:6D:04:4E:7E:E7"}}},"request":{"raw":"POST /ct HTTP/1.1\r\nHost: obseu.northwavepoint.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 4539\r\nOrigin: https://encrypted-exodus.com\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://encrypted-exodus.com\r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/json\r\ndate: Mon, 08 Jun 2026 10:11:39 GMT\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\npragma: no-cache\r\nset-cookie: cg_uuid=6efa418314b10cddbcf2619db9dd075e; Max-Age=29030400; Path=/; Expires=Mon, 10 May 2027 10:11:39 GMT; HttpOnly; Secure; SameSite=None\r\ntiming-allow-origin: https://encrypted-exodus.com\r\ncontent-length: 1425\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":4121,"size_decoded":2049,"mime_type":"application/json","magic":"JSON text data","md5":"7f4786768782845b0704fd783a3c3528","sha1":"e9e02405751866aa3e3cc43c888a558f2f441040","sha256":"9ef37e630baf198ae1f009f622c5fe5cd112cb167569195fd99d486bd9753874","sha512":"55b7813e6302f2fef117b22b57fd95f02ad5d4d925a4824f0d83f0c353d322c7a8dc6fd67dbaa9365a02938ed8c62c85cdd0a8eaf8a265298d88d6680a174299","ssdeep":"96:p/iEfwTVrsbhc+Vk+2ndQCKt/ilfwTVrsbhc+Vk+2ndQCM:p/MVQ9FBiO/7VQ9FBi4","tlshash":"17812a2b9fb11eb681aa6701d8973fde253e8a67a9c3ec8c547501832fe73244d41c72","first_seen":"2026-06-08T10:11:49.063403Z","last_seen":"2026-06-08T10:11:49.063403Z","times_seen":1,"resource_available":false,"data":null}},"time_used":15862,"timings":{"blocked":-1,"dns":3,"connect":15686,"send":0,"wait":70,"receive":0,"ssl":102},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"obseu.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"obseu.northwavepoint.com/mon","fqdn":"obseu.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"54.75.69.192","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:40.785Z","timestamp":1780913500785,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.northwavepoint.com","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 09 May 2026 00:00:00 GMT","end":"Fri, 07 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"81:BC:A9:21:63:E0:B6:9A:20:C7:07:EC:3A:69:03:A1:17:C1:42:A4","sha256":"02:6B:C6:85:E6:24:7C:BE:F0:52:8D:76:04:40:96:61:C7:23:C2:DA:A4:38:F5:F9:19:BB:7C:6D:04:4E:7E:E7"}}},"request":{"raw":"POST /mon HTTP/1.1\r\nHost: obseu.northwavepoint.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 2979\r\nOrigin: https://encrypted-exodus.com\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nCookie: cg_uuid=6efa418314b10cddbcf2619db9dd075e\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://encrypted-exodus.com\r\ncontent-type: application/json\r\ndate: Mon, 08 Jun 2026 10:11:40 GMT\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":3882,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T02:47:09.742098Z","times_seen":17682818,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"obseu.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"obseu.northwavepoint.com/mon","fqdn":"obseu.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"54.75.69.192","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:42.790Z","timestamp":1780913502790,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.northwavepoint.com","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 09 May 2026 00:00:00 GMT","end":"Fri, 07 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"81:BC:A9:21:63:E0:B6:9A:20:C7:07:EC:3A:69:03:A1:17:C1:42:A4","sha256":"02:6B:C6:85:E6:24:7C:BE:F0:52:8D:76:04:40:96:61:C7:23:C2:DA:A4:38:F5:F9:19:BB:7C:6D:04:4E:7E:E7"}}},"request":{"raw":"POST /mon HTTP/1.1\r\nHost: obseu.northwavepoint.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 2095\r\nOrigin: https://encrypted-exodus.com\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nCookie: cg_uuid=6efa418314b10cddbcf2619db9dd075e\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\naccess-control-allow-origin: https://encrypted-exodus.com\r\ncontent-type: application/json\r\ndate: Mon, 08 Jun 2026 10:11:42 GMT\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":2998,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T02:47:09.742098Z","times_seen":17682818,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"obseu.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T10:11:21.939Z","timestamp":1780913481939,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"encrypted-exodus.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 06:58:47 GMT","end":"Sat, 05 Sep 2026 06:58:46 GMT"},"fingerprint":{"sha1":"FF:E0:9B:AA:56:E7:1F:03:A9:E7:6D:31:EA:6F:4B:17:E0:CF:CC:7C","sha256":"81:EC:F4:81:9D:81:C5:0F:B5:37:46:AE:09:6D:6F:44:72:89:74:65:3B:2F:66:5B:20:8E:4D:32:3E:44:90:D7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: encrypted-exodus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ch: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile\r\naccept-ch-lifetime: 30\r\nalt-svc: h3=\":8443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 08 Jun 2026 10:11:22 GMT\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy, 0.0 Caddy\r\nx-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_jmfQV3iQ5eZjr71qh9AKIjKpr9yEw0JBYuWUD129Jr1sqKRPny/cJSrxI5offXomD+5fAMqtKwdCTPm8w9EIew==\r\nx-domain: encrypted-exodus.com\r\nx-language: norwegian\r\nx-pcrew-blocked-reason: \r\nx-pcrew-ip-organization: Blix Solutions\r\nx-redirect: skenzo\r\nx-subdomain: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":16372,"size_decoded":6192,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (520)","md5":"ef4da75727c3b35545f613eda82a129c","sha1":"edb50c4f3d5e16da050f06f159d94f5a873f14e6","sha256":"2da70576b01769c1067df30f34c1c1ca9ccad7251c92a93f7db51206d29375c4","sha512":"65b11516e73510913fa350ae9319dc5e7b007b11e5b96403080f21b03ae8e7d9f1f0e3eba417c96e159440f62d0c50c22809c6186fee1dd49a4270d0ed68d4b6","ssdeep":"192:BR8pKfsTxcYoHSiF57zA5GYJcIaeKIxOJdt+Net2n0llgeWHbOSD8YoHsfOBro2V:BexcYoHSiF5hnoNo2lTH6BYoHsfO2/e","tlshash":"4b72c8477fe31519f11bc0a98f9ea34932289107960fcdacf9ec7698df4819461a3b8c","first_seen":"2026-06-08T10:11:49.065161Z","last_seen":"2026-06-08T10:11:49.065161Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1082,"timings":{"blocked":0,"dns":89,"connect":103,"send":0,"wait":222,"receive":0,"ssl":668},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/abf7be6f-d36f-4658-a432-be234a2e8420/eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.f9JNocb8dmppKDakXGPovvV7MN7fGcFRxupOe8w4VjNfaAbIY2tduA.IAoLjr2gc8iIjRZBNWjQoA.txitA_Riyqnemcz8_3K6wE0oyPQWVwx6CUoitLKWkgKJGyfaSj-5gPPvw4MpggusyUgTvkbhwbt1fPvGqe3Si4CIDeRapqy-wwQ1l6mmoTuuEMJwGdebsoyKohsQyircM12ZWwIzTHkIyQslz2usfstLJiRhVk7hdnkRROQWbmooO6-YC16IiCDHX-PKMSnYeC89h6nOhCUAytGlbqk9vO0oOCarluLcsU-3kOB1V-yDgVhxikj7JRnFn--3_qbylToU29XaRa5zBoBKLj-tmFnlhuNBl1CWuTGni4o45XmHMv-fWXS0gBD1sRP90IYt.7PDEKX_EviKce57fFygLHA","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:23.549Z","timestamp":1780913483549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"encrypted-exodus.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 06:58:47 GMT","end":"Sat, 05 Sep 2026 06:58:46 GMT"},"fingerprint":{"sha1":"FF:E0:9B:AA:56:E7:1F:03:A9:E7:6D:31:EA:6F:4B:17:E0:CF:CC:7C","sha256":"81:EC:F4:81:9D:81:C5:0F:B5:37:46:AE:09:6D:6F:44:72:89:74:65:3B:2F:66:5B:20:8E:4D:32:3E:44:90:D7"}}},"request":{"raw":"GET /abf7be6f-d36f-4658-a432-be234a2e8420/eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.f9JNocb8dmppKDakXGPovvV7MN7fGcFRxupOe8w4VjNfaAbIY2tduA.IAoLjr2gc8iIjRZBNWjQoA.txitA_Riyqnemcz8_3K6wE0oyPQWVwx6CUoitLKWkgKJGyfaSj-5gPPvw4MpggusyUgTvkbhwbt1fPvGqe3Si4CIDeRapqy-wwQ1l6mmoTuuEMJwGdebsoyKohsQyircM12ZWwIzTHkIyQslz2usfstLJiRhVk7hdnkRROQWbmooO6-YC16IiCDHX-PKMSnYeC89h6nOhCUAytGlbqk9vO0oOCarluLcsU-3kOB1V-yDgVhxikj7JRnFn--3_qbylToU29XaRa5zBoBKLj-tmFnlhuNBl1CWuTGni4o45XmHMv-fWXS0gBD1sRP90IYt.7PDEKX_EviKce57fFygLHA HTTP/1.1\r\nHost: encrypted-exodus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://encrypted-exodus.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 \r\nalt-svc: h3=\":8443\"; ma=2592000\r\ndate: Mon, 08 Jun 2026 10:11:23 GMT\r\nserver: Caddy\r\nvia: 1.1 Caddy\r\nx-log-success: 6a26954baaf5b7152c299869\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":177,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T02:47:09.742098Z","times_seen":17682818,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-exodus.com/favicon.ico","fqdn":"encrypted-exodus.com","domain":"encrypted-exodus.com","tld":"com"},"ip":{"addr":"104.247.81.99","port":443,"asn":206834,"as":"Team Internet AG","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:23.712Z","timestamp":1780913483712,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"encrypted-exodus.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 06:58:47 GMT","end":"Sat, 05 Sep 2026 06:58:46 GMT"},"fingerprint":{"sha1":"FF:E0:9B:AA:56:E7:1F:03:A9:E7:6D:31:EA:6F:4B:17:E0:CF:CC:7C","sha256":"81:EC:F4:81:9D:81:C5:0F:B5:37:46:AE:09:6D:6F:44:72:89:74:65:3B:2F:66:5B:20:8E:4D:32:3E:44:90:D7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: encrypted-exodus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":8443\"; ma=2592000\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Mon, 08 Jun 2026 10:11:23 GMT\r\netag: \"dfu820j7awxu0\"\r\nlast-modified: Wed, 21 Jan 2026 11:14:12 GMT\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":309,"mime_type":"image/vnd.microsoft.icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T02:47:09.742098Z","times_seen":17682818,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"encrypted-exodus.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"yfdpco1.com/sk-park.php?pid=9PO15V947\u0026dn=encrypted-exodus.com\u0026ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A134.0%29+Gecko%2F20100101+Firefox%2F134.0\u0026requrl=http%3A%2F%2Fencrypted-exodus.com%2F\u0026al=en-US%2Cen%3Bq%3D0.9","fqdn":"yfdpco1.com","domain":"yfdpco1.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:23.776Z","timestamp":1780913483776,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /sk-park.php?pid=9PO15V947\u0026dn=encrypted-exodus.com\u0026ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A134.0%29+Gecko%2F20100101+Firefox%2F134.0\u0026requrl=http%3A%2F%2Fencrypted-exodus.com%2F\u0026al=en-US%2Cen%3Bq%3D0.9 HTTP/1.1\r\nHost: yfdpco1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-03T02:47:09.742098Z","times_seen":17682818,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"yfdpco1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"obseu.northwavepoint.com/tracker/tc_imp.gif?e=37dfbd8ee84e001262eece34e94383949225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d57138d642f17070100b1eabfd72e30d69183042b3e18f6646541c2628b70cd16365075c256015736055b94bf6b1c31f666b133db4ff19a6fa25b3bf80d2a7f44c84ffe1fbe85ddcd3cb82d19f97adea954659005344163588b934131b723f8b388a75f45af34d0fd60b47d8b74c14e851538c9745bad4b01473cb52d3ea7dfa2f46cff1ab458da17f85e3975bddc273b7d70588661979d00e07360abc8ee3d4f7a23d6862f208a902a476811275843b88f2f646307b6e65b3bd9eae72482e108271425a3a3f391cb25b688df5eed569a0e6c379ebc92b3a533c1dbe36d962112c3a79c3e1215f0606ca08c0621ac84e97e9d5ebb02f2c712dd509e912c867175d2cc73c530d88dbcb6ccf1b04677e93daaa9ae7c433ebdcf71d2e113f01a1813dd5e5b86ccc3c981a4c51ce56a9edeb5c820be323b23873873c2dad15e20d4ef63bb06f7d315d637e13d43411494769c0bcde1a971b3c5778517c39fdfd460ce170461fe4a1f567d5f75caa023ec05d88cc964a09d44f39b2bd694c2f83dd7f0a81f283e8ce97f4ad0b0054c29f2acba74b92886f81eb3f224d97fa1328952d414d7a820c61a27e6a68e673f3f6303360a5c17a9e3906dd202b443524229f8b747c399180cfabfc3b9a071cbede5ff9ae5a6f14a4820e64684be4573804b6207ca605b7570eb7cae7705dfecc067967dd1258ac630dfec48c02f1d2b320362129bc8e4d23d7851921b5be38abeb3edb05b4de7f5c82f9085191ecace007f2ca0c5cb5c33b6398458971aea3e9816d3cb0d81e97ba8ccc8b49d3802b4e2416acb1cb491a2ef53c538261c1795764257b9a3568eef10c29a85a20384ddc566466210e159d356ae0dd093758470037753301612fd48ccc56a47b36fdcb5a1649d9e31d32722eb482372fdbd865305b063ff8c0cc853644258b6382d81b3c52896062c90840fb39f80aac250d05e542109e03778108e9a0c40a863a4ad903f85d2f01c023ff13f621a0ecc1653fa8bb15b42d2707bd38b95189f81a8c5583ea861f8156053cc4d237bc9c24605d290f1dcbcf74fbd26b4368637cb9d0ad6f1ea7974b6d152c8d5aced878194927301d9a4375f8958cb54c901a6a75df18d98832efa94c9eabc1329c3bdf4f4519d08ce0f563b523dd6806674cc26b3008cd667ef4a7da13c4cd222ebdf3d20e236324436c3aa8b68c7990b7c2a0e3edacdd5a8df348456e8f7672c9c820a1a520210794dbf7ce0a02209a9b5da93b5fae5f9f1\u0026cri=wc2D9sC3or\u0026ts=15895\u0026cb=1780913499785","fqdn":"obseu.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"54.75.69.192","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:39.788Z","timestamp":1780913499788,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.northwavepoint.com","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 09 May 2026 00:00:00 GMT","end":"Fri, 07 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"81:BC:A9:21:63:E0:B6:9A:20:C7:07:EC:3A:69:03:A1:17:C1:42:A4","sha256":"02:6B:C6:85:E6:24:7C:BE:F0:52:8D:76:04:40:96:61:C7:23:C2:DA:A4:38:F5:F9:19:BB:7C:6D:04:4E:7E:E7"}}},"request":{"raw":"GET /tracker/tc_imp.gif?e=37dfbd8ee84e001262eece34e94383949225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d57138d642f17070100b1eabfd72e30d69183042b3e18f6646541c2628b70cd16365075c256015736055b94bf6b1c31f666b133db4ff19a6fa25b3bf80d2a7f44c84ffe1fbe85ddcd3cb82d19f97adea954659005344163588b934131b723f8b388a75f45af34d0fd60b47d8b74c14e851538c9745bad4b01473cb52d3ea7dfa2f46cff1ab458da17f85e3975bddc273b7d70588661979d00e07360abc8ee3d4f7a23d6862f208a902a476811275843b88f2f646307b6e65b3bd9eae72482e108271425a3a3f391cb25b688df5eed569a0e6c379ebc92b3a533c1dbe36d962112c3a79c3e1215f0606ca08c0621ac84e97e9d5ebb02f2c712dd509e912c867175d2cc73c530d88dbcb6ccf1b04677e93daaa9ae7c433ebdcf71d2e113f01a1813dd5e5b86ccc3c981a4c51ce56a9edeb5c820be323b23873873c2dad15e20d4ef63bb06f7d315d637e13d43411494769c0bcde1a971b3c5778517c39fdfd460ce170461fe4a1f567d5f75caa023ec05d88cc964a09d44f39b2bd694c2f83dd7f0a81f283e8ce97f4ad0b0054c29f2acba74b92886f81eb3f224d97fa1328952d414d7a820c61a27e6a68e673f3f6303360a5c17a9e3906dd202b443524229f8b747c399180cfabfc3b9a071cbede5ff9ae5a6f14a4820e64684be4573804b6207ca605b7570eb7cae7705dfecc067967dd1258ac630dfec48c02f1d2b320362129bc8e4d23d7851921b5be38abeb3edb05b4de7f5c82f9085191ecace007f2ca0c5cb5c33b6398458971aea3e9816d3cb0d81e97ba8ccc8b49d3802b4e2416acb1cb491a2ef53c538261c1795764257b9a3568eef10c29a85a20384ddc566466210e159d356ae0dd093758470037753301612fd48ccc56a47b36fdcb5a1649d9e31d32722eb482372fdbd865305b063ff8c0cc853644258b6382d81b3c52896062c90840fb39f80aac250d05e542109e03778108e9a0c40a863a4ad903f85d2f01c023ff13f621a0ecc1653fa8bb15b42d2707bd38b95189f81a8c5583ea861f8156053cc4d237bc9c24605d290f1dcbcf74fbd26b4368637cb9d0ad6f1ea7974b6d152c8d5aced878194927301d9a4375f8958cb54c901a6a75df18d98832efa94c9eabc1329c3bdf4f4519d08ce0f563b523dd6806674cc26b3008cd667ef4a7da13c4cd222ebdf3d20e236324436c3aa8b68c7990b7c2a0e3edacdd5a8df348456e8f7672c9c820a1a520210794dbf7ce0a02209a9b5da93b5fae5f9f1\u0026cri=wc2D9sC3or\u0026ts=15895\u0026cb=1780913499785 HTTP/1.1\r\nHost: obseu.northwavepoint.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nCookie: cg_uuid=6efa418314b10cddbcf2619db9dd075e\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-type: image/gif\r\ndate: Mon, 08 Jun 2026 10:11:39 GMT\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\npragma: no-cache\r\ncontent-length: 43\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43,"size_decoded":270,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"db04c7b378cb2db912c3ba8a5a774ee3","sha1":"dee34bd86c3484d31002182aa2b7caa4699126b8","sha256":"98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a","sha512":"826225fc21717d8861a05b9d2f959539aad2d2b131b2afed75d88fbca535e1b0d5a0da8ac69713a0876a0d467848a37a0a7f926aeafad8cf28201382d16466ab","ssdeep":"","tlshash":"6490000bca888002caa2c0302b8883022b88b0320228832e80bc30a8ee3b3a20c02000","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-03T02:49:54.711217Z","times_seen":412672,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"obseu.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js","fqdn":"euob.northwavepoint.com","domain":"northwavepoint.com","tld":"com"},"ip":{"addr":"13.249.8.68","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://encrypted-exodus.com/","date":"2026-06-08T10:11:23.537Z","timestamp":1780913483537,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.northwavepoint.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Thu, 29 Jan 2026 00:00:00 GMT","end":"Sat, 27 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"CC:B5:FD:45:6E:B8:DC:24:11:6A:30:38:E9:1D:FB:81:45:2E:FA:8D","sha256":"32:3C:54:8F:1C:33:6B:BE:0F:39:18:D6:DB:E7:61:78:95:9A:27:61:E7:33:FF:DA:F0:5E:F5:B4:82:D5:5E:A7"}}},"request":{"raw":"GET /sxp/i/636f8b858f681acb7bfa6f583a96630a.js HTTP/1.1\r\nHost: euob.northwavepoint.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://encrypted-exodus.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 51295\r\ncontent-encoding: gzip\r\nserver: Caddy\r\ncache-control: max-age=43200\r\ndate: Mon, 08 Jun 2026 08:01:27 GMT\r\nexpires: Mon, 08 Jun 2026 20:01:27 GMT\r\netag: \"216ef-2I6gVk/Vivdkt0GwpQ54tFI+cQM\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 b3fa44f24855583147e402819cdc6b70.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: JrbfE1qMxc7n5YyXbJP-PE0ElWEzw8IGk5KVm0LtwXXXDT1BqMUzeQ==\r\nage: 7796\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":136943,"size_decoded":51818,"mime_type":"text/javascript; charset=utf-8","magic":"data","md5":"1bb3ab22ed57318ee11d270c1c3f59ce","sha1":"d88ea0564fd58af764b741b0a50e78b4523e7103","sha256":"93c03215b2f3bdddd55ce066691d5fba626924cb98f3eaab8ce8e177d030599a","sha512":"8cd9d5fb4c2cc64831f03cb4c770788b233770dd82edf5d4b5c1670b6c7d8d5d741214857b702f1ed6b06bea259f3149b9a289805770bbdc8d5228c2c0c66457","ssdeep":"1536:sD+qPQb5SEwvAu5DWeBPU4HLonMbVGhe3qM87961QCixUcnYtB/l7PsXWIo6MWmN:sCqP/AuZWyjqu1QCtveXolS0nInWBypO","tlshash":"8bd3d7ddf2e27025039320a5017f411ae27b1e553c4b8290d5bae9d4ac7ce8e957bfac","first_seen":"2026-06-01T21:19:08.293855Z","last_seen":"2026-06-14T18:29:01.620025Z","times_seen":3492,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":14,"connect":10,"send":0,"wait":12,"receive":7,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-07","alert":"Sinkholed","trigger":"euob.northwavepoint.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}