{"report_id":"86b41ba6-dddd-4897-b273-16b5ebb57066","version":6,"status":"done","tags":[],"date":"2026-03-20T18:55:54Z","url":{"schema":"http","addr":"walletrust-ext.my.canva.site","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.6","port":0,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"final":{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"title":"Trust® Wallet Extension⋇ | Get the Trust™ Wallet App* Now","dom":{"size":59048,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (20257)","md5":"0209f2f964f3789e49c2cb99ead995cc","sha1":"2818747a5d0ec618665f4ee307d8d50f2508eca3","sha256":"d2208c41882d70686230025a7a6f87b46ac2efa0e75c3fcb3db7ca83777e5640","sha512":"fb0c7716fead834ca36856c2b4fb0736e930fbfeb6718eee45e568d55cf955be331b16f589f72795a2bcba63daee6bf09e36d3b9c0674a508d72487f556abd7e","ssdeep":"768:dG/t8VNp1XM6oBSfDyFMw9XFAYtBmVONkB4tOZ7AX8cRxgBlt+NQ2yp5VFJR7:dG/6Rymw9XFAYLGwyNR7","tlshash":"4843081a57261256155788cab2e36729337d8207f3c14da473ee8b29cfcb9ed138234b","dom_hash":"domhash0004d859713cc95c02dfc5d4cd73d55c","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"walletrust-ext.my.canva.site","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.6","port":0,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-24T18:55:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"walletrust-ext.my.canva.site","ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"domain_registered":"2018-04-03","domain_rank":0,"first_seen":"2026-03-20T18:55:58.63718Z","last_seen":"2026-03-20T18:55:58.637181Z","alert_count":70,"request_count":70,"received_data":7707407,"sent_data":49579,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/ebd1175b57d4894b.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"b2c3b5bb4327283e88e67ab871929c28","sha1":"2601286419bd1a508408f0dee18482cd306f1d50","sha256":"de6d6eb659bc2ada0720f405984c7d1bee996f6916aad66073d8b916dd2a1a02","sha512":"36ce8bd12f67365c19af77a9a2d0e5ebd4dae48279af131df9e94b4fe8d10240d9c0e4d9b29408b4f4f83a3a2f8b8d1e0103ea1776ec182599b2d6420519af81","ssdeep":"24576:F4L/WQ26ggvimj4GOnJ+is81vC1hqKTidQFXs2mTqxxr4G6+mYAzrCpvlhud21pr:c/WQ26ggvi9LnJ+is81vC1hqKTidQFXz","tlshash":"8f752a95b2a3b059c223d8d5903f0046f53abd49f00c8cbcf6aedce67958945627af78","size":1551339,"data":"","first_seen":"2026-03-20T18:56:02.250806Z","last_seen":"2026-03-20T20:07:30.780866Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/a1201a4daafdda7f.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"d880a538ef87aca0a57154d7426ff8e9","sha1":"9d87eae1768409e32c1e8bcd999ded35c9252adf","sha256":"20c5fedc0a79df73d157a582336d49758714050553a7f90b1a0276b22fb67cd7","sha512":"1607c9c821c5efd09a6a151e7328b28d5b0b0431cdb794174637675b890b936b5fe946ca49613b40cad1d8af4dbf8912b3f1215d1df8109c251b38e422ff0260","ssdeep":"1536:HVclssXGYAHArPt7mUJqWbFLuoUN9eJtjulvEEH:HaaHArPt7mUJqWhLuJN92ulvb","tlshash":"6133e964f5a2b05cc676dddac07f0079b11a7e0d7209d8bcf26bd8e668946493239f38","size":52288,"data":"","first_seen":"2026-03-20T18:56:02.227866Z","last_seen":"2026-03-20T20:07:30.768408Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/37a5d2cf3f47fd68.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"0d3e1e7d7891f5654bc7e5dc02f9b2c6","sha1":"a82e054d90aca28b42888501e5f0c5ebd70be80d","sha256":"761ac60bc96f1072a7cfd7e481481afc85598dd6e695a6eef16f0f0fc8ea5543","sha512":"e75f783b65d49c5c2e7e3bba092c9734c357dab78280e4e002d817a25e9e8de552a6ee3cec58cab9e6f3c478a03bee0f19bc92332dca756a0a1048a602634937","ssdeep":"","tlshash":"13e02b8c3559fc22207739f086ce3a318227970338206d8995724eb515b655ad3f6c76","size":409,"data":"","first_seen":"2025-11-02T03:36:46.662034Z","last_seen":"2026-05-16T14:02:24.268574Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/2596d93acdcc228a.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"be21111843cacfa4de8ab73603a8e4d8","sha1":"9904ea0be9356c4c98b15e0eca029127a537433c","sha256":"ed4bbbb46e91801a41b1b0ecfffc5cdbbe0c737b9e9ea1edcc439f82bbe48ee6","sha512":"be6315fd9b770818dec7cde11fc71779b9f3ec276053e3d6223e14539b16b6dfa66beff5b64ac788aba0a71b3a5ac839c2032d057067e236215c7d1a41bbd398","ssdeep":"384:7VJNKF0Vbvob3yAqp9LKF0lE1Vx7USYlut8t8/Pvpq6ZNxwX7Ql7qoQW2RRhiipb:7ZKF0VDob3wpYKE1VKSYluGt8/DZDQ8y","tlshash":"7972e708754b749bc6b2f8e8007f1095f8b99d01f00c9cf6bda9e8c2ac25c4951bb7b8","size":16509,"data":"","first_seen":"2026-03-20T18:56:02.202758Z","last_seen":"2026-03-20T20:07:30.743209Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"de02bcc9df08b71a45253dccc73a129d","sha1":"dc779b9e802022f5007a41ae83a8d6e197b5396c","sha256":"2865f21e60a22afd016b51545f134eb6c62599c58ef9c63e1239c6b95557ec73","sha512":"69b1658c4d4aa298e9f31595cee37ccc1dd475cf27f048493b84e77f5ba4190163d5cacbba69621eb516c731147a4f60836d2798bda10592c7f471e32c1fe823","ssdeep":"","tlshash":"86d02b3baf8bdd9190abaf210e1e34f00a7486319c6416384998145c599c54bd5ebd4f","size":271,"data":"","first_seen":"2026-03-20T18:56:02.252128Z","last_seen":"2026-03-20T18:56:02.252128Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/3af688e02ca99058.vendor.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ba49086fbba7bda634981235d43a9502","sha1":"eec6f3ae850c31988ae29c3e551731993b73a545","sha256":"5018b1c41049b65a24d73f8b62a60d6239618bb6a52fca3be1386fba53dee815","sha512":"53c2f10a164b3378a201a5eb08706c2a8c30b1eb7132825e3576f40d1e61cbf0442df7d8fa0e685c5ea3eefabf74fb2d57e96d960cc4173d7931453376dd29af","ssdeep":"3072:hRYYsAwlvH+ZA2oheWnYMEWut6+qnBkqRR1zq:KlvH++2fWYMEpErBR3q","tlshash":"bb14f9d87996f16157b352b740af1407b33d2a1b280c8960f211fcca79b845ea17bfad","size":205590,"data":"","first_seen":"2025-11-02T03:36:46.647267Z","last_seen":"2026-05-16T14:02:24.297521Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"975575a9756c66f755af323c9ebe5b09","sha1":"5ffe7811d2c9ca914961eabb4a8fb0dc7320bc13","sha256":"87ac847199cb241d0f4e9d3259cfee338e17696f065ea1d453412f47c067d913","sha512":"d7cf87ea9c70a530db8aef03258b6312aeba6eb91478a701c7e2ab3e7884c63b7be0c1cff578d4eb90040b0dd34888784382959a60c634518b2819355c69ced0","ssdeep":"","tlshash":"92e0c23658a6047122bb81392f9bea0227202183ae05ea5dbb4d4a891f40d1c92b06d5","size":299,"data":"","first_seen":"2024-11-08T09:02:36.362715Z","last_seen":"2026-06-05T01:37:36.226497Z","times_seen":2010,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/b1eeac0bf5be0efc.vendor.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2af8a464f14dde03737b2a22a2790e8","sha1":"1c218bd22d0febe932a4b55072fd7c79467c9adb","sha256":"43a32d84ab310e4391bab25bc5d87727f98eb41bf38dd4d1b3ef4085caceeb73","sha512":"141fed32974759a222420a2bfc2e204baf6ebfc5e3f011c0071bab46c480894400ff1a492fdd81d8cf75827964e0dd773170fc5d11879838d12185db7e036f17","ssdeep":"12288:g1sdtIw1t8UEF6MNAPoRjTfH5ZrcTvcGbYzqZfqTmcGR5kDJg2/Lrdsj9NbNqEAh:ksd51t8UEH2PqjTfH5ZrcTvcGbYzqZfO","tlshash":"e8f409cc7191b471539361f6406f010bf33e6969680d8168f269e8e57cb998ea33bf78","size":775281,"data":"","first_seen":"2025-11-02T03:36:46.640177Z","last_seen":"2026-05-16T14:02:24.27748Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/6c7d23e087795044.strings.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f227bcee40a4324ff1b01792affc455","sha1":"097083fcfb30029c5e46b4a25e55206803d3347d","sha256":"1d0a9898dc268701222ab4b0714d86adb7652ab6f8ff68c1bb6eab3e08391fd5","sha512":"a6e4e731d4db1204243ef0bedb9df442d1ebe5df44cb137cbab3183c999cc98747a64191c4992f1cbcf0b3c37e6ef511c8a66508844a0cbe87e0bba815125efb","ssdeep":"96:bytVoHXnxWpyo034Nf+qzNoBvv37Pqy4+54W97fHaoG:GtVo3xWYo0INfZq5v7P9B5h7ZG","tlshash":"df9131350742d20cccdb9a484ab83de4716ac4d5b6533739fd6ac0ad52cbc78be8da48","size":4317,"data":"","first_seen":"2026-03-20T18:56:02.214635Z","last_seen":"2026-03-20T20:07:30.775711Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/2a394861abd07a6d.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"4e3ea90a3973fd092730f96c0da35743","sha1":"97f05fd4c491458008ed31d5e8ac70b66822455d","sha256":"51bb98921ca7fe7c8fdeff0be0576b177cd5bc18217640f1826b76609ab7f8d1","sha512":"19f1f3d969e7cf62cfae23c675abd360235986cd81f729f1581242ff1e4e5e107d11140d6bb2283305ae68b042eedf92c1bdf11a143226b6c3d2b298362a563a","ssdeep":"192:qhJo2DnU8xHK+qZNeuqipqImO4mzx1n6Sy7Q5Y5+5S6zju2cC7AyR4D0nQuDkuC/:qhJoUnU8ZaZnfRP4U7XVX5nzkj20","tlshash":"2a22d748bb87a45b4777a8a4407f00a1ed1d3a18b04cacddfa6bd4e3a525c74523eb70","size":10347,"data":"","first_seen":"2026-03-20T18:56:02.20437Z","last_seen":"2026-03-20T20:07:30.752073Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/44f10781a34b80cc.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f7b8a1397737484d13a3379773a74ae","sha1":"c4e931a370266b4ee214fce549ec9c70344acd7c","sha256":"a438d87a5c21d7db5abfa5052557d3858db8ae569635e9480e1cb03b07da0e56","sha512":"188d16419e017a4b80afe16456bfdb8402a95ce02dad3fb686ecce0b76a2f208279844fbaae03d2ec52080248d34adcab6923da0b955353a2837a3629a181c57","ssdeep":"768:iNHaG7VinkfNseI2IJmzBENlsxBN9eKNP5vF3L0O7xgUtm5B472lDPZIL7f+JaXs:0No0xxRVFYOeUszla7EaZ691FY3bbrNI","tlshash":"24033a6572a6f07da123c9e0c13f5115622f7458b00cc8ecb5bd8de9685a4caf12bfb9","size":38495,"data":"","first_seen":"2026-03-20T18:56:02.224007Z","last_seen":"2026-03-20T20:07:30.765903Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/9ad40ed84eca5867.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"80d5471bfc886b30f15c1a478c9cba43","sha1":"83a363278e2410005c8197b7266b57a1b71e485f","sha256":"ea561cee9c5794111d57be8639614cac892026937d318313423e750ab1d016e2","sha512":"8f02e58dfdb9750da4e64a44ffe0a05aec28921747f58c2444d3b8e99f4134bdb6022eda354f467ab687eee459222bef0bc825f9fdbdbe8539ff8d29b0566859","ssdeep":"192:68JNpCo+jovOYPz9BDVzGGAiOR/mzKSZFw+eNyuUK8hiC4fbSqU3G2W:68JNcoXZVdAiORuzKCw+eslH3G2W","tlshash":"f8120a18b23670568137ece5d07b162fa629b814b10ce8dcb259dde9a1745a33379f3c","size":9678,"data":"","first_seen":"2026-03-20T18:56:02.19998Z","last_seen":"2026-03-20T20:07:30.759766Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"b59064fb8f1aa77295f59a4f5e226565","sha1":"0506e6562d14f79db6ce5fbbc93ac692d7bd9213","sha256":"ef98aaeb8a0712d424de5b5202b02b51914837bac061ca4087e83dbe1a6119fe","sha512":"b1b7c5dbc2bc6c45e0dff93734204de88810f58fd86872b629fd26e983775268f91c5618da3b0f3037274292f40979bf7845ebbe4ada3d867775f31a3f3ff0f8","ssdeep":"","tlshash":"7041cf7e18a9b57111ff24fe929bc6c97a306886fd455c96386c9f512f428c2402abcf","size":2279,"data":"","first_seen":"2025-11-21T02:46:50.382594Z","last_seen":"2026-06-01T18:42:29.421879Z","times_seen":154,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/3e11a84bbdce17d0.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"56ef65c24c4d250fb5ec4e089ccd82e7","sha1":"a01dc269d9568318e779e4e7a5f6e181c6cdc4d5","sha256":"a7684614e12af4ddc04c7bfbd04cf704b2f9102d8c29e82a635f1f93497d5e58","sha512":"9ea772e302101d88778c887ce9d3e0cffad5b9a7b42065dd30377c669deca109b9f7a398b51c67d37279801d5fe71503d2603f2b9ddb8151ca84314ed9497fe4","ssdeep":"192:5nJRVZV7u6Fm1MUT0deZ2mrqhJDCTcdm2B:5nJbL7u6UTXomrqhJDCgdm2B","tlshash":"78d12a6110c91f954461d2caa49a34f45efccf1b30c8cdbae914e66ac974e8f83b6662","size":6454,"data":"","first_seen":"2026-03-20T18:56:02.232809Z","last_seen":"2026-03-20T20:07:30.764321Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/d0cfc50bd9a7e968.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d7b6169e6e4ca5e810fa2ee7e067679","sha1":"48b4f08ab35a9d73040e6930ca51b830d696aca3","sha256":"5f545d14c5fdc7442889a74c32c04da51316116b212d1277d5f32870df7406b2","sha512":"87094302a0ce9e98aa7efc24d750667f6755dc261c0829890b702bc5ef4c5579a4e4cbb6643c6a9334cf5df0bc87b9eebc2c6920f31684fd6c19e0864f6a276c","ssdeep":"768:dBWU87GGi+cm7ggclMac6/W10TgRYXSrV/tTyWwe08GtKVaOeAXyXJA/rgWPASZB:3sG+cm72l+8XSZ0SCAzTV","tlshash":"0a13094976c7626386b3a4d1703b8586a8b53f32f04eacf4b646c1f0782ac14d7b7766","size":42572,"data":"","first_seen":"2026-03-20T18:56:02.211875Z","last_seen":"2026-03-20T20:07:30.755665Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/4ce3dc17acb5c45d.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9fb3d2e27198c5decb93e6e31e421e1","sha1":"ed6e6fe7cb6e892bca2dfa4d3745118d96070c1b","sha256":"7b274ff65fb57d01fd6ca043d5b7cb39a10cd94cfc1ca693dd65628d8e822ce6","sha512":"e70cddd85682002ce6ec955a8423b671cbabdc0bfcdfaca9441ec2b41dc81133a984047e0ebfed949eae9872fbb8d86d36bc6f418fc2af6cc5f60430a72d90dd","ssdeep":"768:M7e0auEFoY4BeENoiqBI/dfwhRGx0JC5gRk1NFcN3r5w6UTBCIL5n5EWUS2rmAGJ:Ee3TaykfwcUwCdS2c6CR","tlshash":"abd21848b6db605597b3c9a1903f1115a12c7f39f408c8e4e22eddea2858e4e7279b3d","size":29625,"data":"","first_seen":"2026-03-20T18:56:02.20625Z","last_seen":"2026-03-20T20:07:30.757205Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/01942c595a301567.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"081c01724b06f106ac9b1cdb33cd1d50","sha1":"4f7df521113a188aa5afd1c1d6a5ef8a0b2e19d7","sha256":"97903d769cfde98d70d8e00456deb56fba1f4987108559e684e5efc8de619b89","sha512":"8c5d84aaffae54ae9bc22f35011018cf88bf42981dd786e9a51a91c5f74d9a8e4df030320e9afece52a58541f64f49ba00f1945a2c98f48877e1370b647bfc15","ssdeep":"384:cUJsBvOAci86tCIA8yOLKCKF20j0jPF2ju3fc4Qe2Z:c9vOi86tCroBj2u3ffQh","tlshash":"85520a84b699b56ca1b398e4c43f4092f21e5a50f44cc4ddb9bdfde9b8a4801e623f74","size":13741,"data":"","first_seen":"2026-03-20T18:56:02.208053Z","last_seen":"2026-03-20T20:07:30.758951Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"59b4c3d34d32500470aec2f1d67fe685","sha1":"887c0c5b4c9d7142292f9b5e6bf8b64096f0cb09","sha256":"55378ae71af2ecd6bbc1e3ed2b7bd32d9d0fe222140e3b3d5904fb84935306ba","sha512":"2f2d86b492687ddf3ac507de931fb19b49227b233ee29e6a950d4a9deda5671557458a3848fb0fd3bfcaa1e28f736366c7d23d4a751eb35ac46dc7f74cf22329","ssdeep":"","tlshash":"5e900204945a9125491c14181641d615d45244a245ded95b192085361be72d7d400bb1","size":52,"data":"","first_seen":"2023-03-07T12:59:30Z","last_seen":"2026-06-02T00:43:17.198167Z","times_seen":281,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"5c1f008b1f21b570659d95bdc14efd8f","sha1":"62986772bb708dfb996aa9731fdfc94dc98ba6e8","sha256":"546ac5ca85800e20521ebbeffa3e5856022e3b56a11cfbd743696364d1137755","sha512":"a5f62aa12b8e2d7fa22c491e12e9fb72bed26097c54b6556c947d6200fd35ac2f51de0e66b400d2b48c76ea98bc83bb79463f62393b9e046c36a109e6fa06ee6","ssdeep":"","tlshash":"12a0112028880232cca888808e820020c83080aa08ac0a002a280a3a2aae0a2c800280","size":72,"data":"","first_seen":"2025-07-01T23:02:20.504231Z","last_seen":"2026-06-02T00:43:17.199197Z","times_seen":210,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/1ffbbd26c29ce4f7.runtime.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"5b8dc512c921cec1a1573f0341ad9ad5","sha1":"d2c6b930b9944290bc92f14131cbb5885875e934","sha256":"3a1f1d412d4e36d7a42ce7b60aa6ea1ae953f20f43d700aa3e2fb00ae52217fd","sha512":"a89b5e89655fe3248fca49d4cf999c90f0d450de5c014720afa38a7c360c069375956dcbc3caec539653a094e793cc907fdbe5b7f526d8ffd5764613a49de93e","ssdeep":"384:bhtUox1yZm/X/blmqlIs3qJBkKf36hx9Polsm23WIJgo6IiJSVS00sa5uufhJSkW:Fa87listKf3ExBo2m2GI5biMVd0JuufK","tlshash":"51a2e5da36b21172e0f12ee8b8a6d052355d4cda30ad5a50dbdb7ce4ff50e62e433912","size":23060,"data":"","first_seen":"2026-03-20T18:56:02.24239Z","last_seen":"2026-03-20T20:07:30.767424Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/b1d2a261e5c9ab06.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"65467e117fbfce7f25ed1acadf0ad646","sha1":"bdd1bd3b67b35f9ef2953d4613b1e232035101ae","sha256":"614a9385aea57ccb9c812728e264980b4475bac4f83a9e8e5f5206873b3c3930","sha512":"8d701709fa3af582c97d1a23c483481ee9fd6edebc3dd92e555f9b06ee7c9bc1455945ed0484ce7da63ea46d1a75c83ea611d5ab59acf28ac57e7a4f9eeef261","ssdeep":"","tlshash":"b9416648364eb878d5b614e8101f1159a602c752f10cfda9b836ccfaf1f4e51a771e3a","size":2421,"data":"","first_seen":"2026-03-20T18:56:02.222192Z","last_seen":"2026-03-20T20:07:30.763486Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/420db561e59f0853.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c7b54849183474845d31af8e53ab421","sha1":"a3c305e96680d281c1245c1e375c44bc7cc9d32f","sha256":"b6dc16f57cd801d79cdaa01f98c169571142d07373e2117dc1c0494ba0c59844","sha512":"f1e683072c1ffc41ba882389922c52e74bc1f3a09eef4e3dba20a3df8e3c92503f68dee1a91e9f45cb1582774659b64b3487a3971cdbba0f6df247345649f3bd","ssdeep":"","tlshash":"0841769878a8fc92786b20d0449f7931e62ba66370154ce0e11dec976c4d5a99336e34","size":2010,"data":"","first_seen":"2026-03-20T18:56:02.234656Z","last_seen":"2026-03-20T20:07:30.758119Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/35e043f524cea603.it-IT.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"97fe24f2d90024c1ae916135dc24aaf3","sha1":"9afe504df31f46341be31273ee27ded71307c075","sha256":"2052326ef760d4e45fb7bdff461934ba389b9dfd8713cfa874aec980127cb876","sha512":"d7c6e05aa8fd79012a79b2139a21c3f0cb2b51b6b59f80e33ac40d4212ecff793b03cebdcd1a4e1ea51dde230059dfdd5ab3c6c68985c2454ce4b2f32f7119e1","ssdeep":"","tlshash":"c3e0cd760092fae8af7b0ebdd25131846815471014a2e6fc88b045a13bf5cc7cf5405d","size":318,"data":"","first_seen":"2026-03-20T18:56:02.240989Z","last_seen":"2026-03-20T20:07:30.766898Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/59453774ec5ccf66.strings.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ee7762db0c78b7a08702ab5c476c3496","sha1":"7a9cc04a2af275c326f37a2fec9d4c2cc5403a3b","sha256":"00f4df7d4576a43853f8bb1adae4eea417cb6c5ce0b1e2a0b71dabf15ec923a6","sha512":"787abbd2c0b5a6b8b831b111e69a4b67601a59566533e51ad14a08f0783a6e2e1f9c08644641b3234fd207aa67238bbe6075d6bada2ae6382150a9c46c75e6ef","ssdeep":"192:bgx2UKPCmggO5K2uTKoTdMWeSxOXI7K1zkFYFyZw5GKhg/xG:bJLHggOc2foTdMbSkXLdkFIy67hy8","tlshash":"87e1a520d581e00cce650e5f563eada4f1c7c1d97b9a3675feadc23c21c75789a60449","size":7050,"data":"","first_seen":"2026-03-20T18:56:02.24614Z","last_seen":"2026-03-20T20:07:30.77045Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"b4c890ff2243345821db61118c0c0cd7","sha1":"223edd9d7dbada9ec1f1fa370e35edd55b4a8036","sha256":"74afcdcda43f659c79d9c447f71bb1f4b8cb6eb27d5b614d360c46eab14b9df7","sha512":"268d2c15c43d496de4ab4794270cabc4c98380476f7e23748c7adaf3077231562c19ad606d99dfcebcc986a369f98b2da5c3caf0e61f779a3f573e88c91b1919","ssdeep":"","tlshash":"22c09bbc1515243f1955565c7157daf43d36147261711510e55c502d4465d9790438d5","size":133,"data":"","first_seen":"2024-02-16T21:25:19Z","last_seen":"2026-06-13T16:08:10.016535Z","times_seen":3087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"24519b447e5e1c6a0f7f714514a83ac1","sha1":"f65116cfa06f85448a08af65f5d3716cc1f2ae61","sha256":"caa540d6ac61afa159465d4cffaa2ef29959c780310ee7f601c1aa95587e5209","sha512":"95a6bcae65254f4f8124a6527c8ca671c7de85deaec8109ecff2cdfe621ffe496dddf32a213f18a601651c5539ccf802e6d214750976254b199eecd7e684a36b","ssdeep":"384:9RYMqBmV1bwYROkB4tOZ7AX8cRR3gNDlt+NQ2yp5VF9:stBmVONkB4tOZ7AX8cRxgBlt+NQ2yp5h","tlshash":"198277065a1626eb5e87d897b1433871b2ec9e2873c41581e3e6dd2cc5e78bd23d2327","size":18883,"data":"","first_seen":"2026-03-20T18:56:02.274048Z","last_seen":"2026-03-20T20:07:30.781943Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/3af688e02ca99058.vendor.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /3af688e02ca99058.vendor.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee878e5875ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":205590,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65455)","md5":"ba49086fbba7bda634981235d43a9502","sha1":"eec6f3ae850c31988ae29c3e551731993b73a545","sha256":"5018b1c41049b65a24d73f8b62a60d6239618bb6a52fca3be1386fba53dee815","sha512":"53c2f10a164b3378a201a5eb08706c2a8c30b1eb7132825e3576f40d1e61cbf0442df7d8fa0e685c5ea3eefabf74fb2d57e96d960cc4173d7931453376dd29af","ssdeep":"3072:hRYYsAwlvH+ZA2oheWnYMEWut6+qnBkqRR1zq:KlvH++2fWYMEpErBR3q","tlshash":"bb14f9d87996f16157b352b740af1407b33d2a1b280c8960f211fcca79b845ea17bfad","first_seen":"2025-11-02T03:36:46.647267Z","last_seen":"2026-05-16T14:02:24.297521Z","times_seen":7,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/ebd1175b57d4894b.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /ebd1175b57d4894b.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee878e6775ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1551339,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (568)","md5":"417bcdd2e412c15363c8d607ee4afeb6","sha1":"8a444415445ebfd233f80e6e150d49f3c23b2da6","sha256":"1a4474f12dea0d2b85269f8ef3fc0f72b58e4b391cd298f70b2bc45dbd14b414","sha512":"de5def9eaba338e7e8bbec1defb6b15c7e5cd72d14cf4e075f88dfc2c7b82bf7749a8e1508734617cda588cdc09343c6bc9b025e00598c5ef19949e7699e8a96","ssdeep":"24576:F4L/WQ26ggvimj4GOnJ+is81vC1hqKTidQFXs2mTqxxr4G6+mYAzrCpvlhud21ph:c/WQ26ggvi9LnJ+is81vC1hqKTidQFXZ","tlshash":"50252a9476d3b05ac223e8e5903f0006f93aad55f04c8cbcf5add9da7924949627bf38","first_seen":"2026-03-20T18:56:02.187421Z","last_seen":"2026-03-20T20:07:30.753581Z","times_seen":2,"resource_available":false,"data":null}},"time_used":861,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":615,"receive":246,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/37a5d2cf3f47fd68.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.553Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /37a5d2cf3f47fd68.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90dd7175ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":409,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"0d3e1e7d7891f5654bc7e5dc02f9b2c6","sha1":"a82e054d90aca28b42888501e5f0c5ebd70be80d","sha256":"761ac60bc96f1072a7cfd7e481481afc85598dd6e695a6eef16f0f0fc8ea5543","sha512":"e75f783b65d49c5c2e7e3bba092c9734c357dab78280e4e002d817a25e9e8de552a6ee3cec58cab9e6f3c478a03bee0f19bc92332dca756a0a1048a602634937","ssdeep":"","tlshash":"13e02b8c3559fc22207739f086ce3a318227970338206d8995724eb515b655ad3f6c76","first_seen":"2025-11-02T03:36:46.662034Z","last_seen":"2026-05-16T14:02:24.268574Z","times_seen":7,"resource_available":true,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/b1eeac0bf5be0efc.vendor.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /b1eeac0bf5be0efc.vendor.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee878e5e75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":775281,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65455)","md5":"a2af8a464f14dde03737b2a22a2790e8","sha1":"1c218bd22d0febe932a4b55072fd7c79467c9adb","sha256":"43a32d84ab310e4391bab25bc5d87727f98eb41bf38dd4d1b3ef4085caceeb73","sha512":"141fed32974759a222420a2bfc2e204baf6ebfc5e3f011c0071bab46c480894400ff1a492fdd81d8cf75827964e0dd773170fc5d11879838d12185db7e036f17","ssdeep":"12288:g1sdtIw1t8UEF6MNAPoRjTfH5ZrcTvcGbYzqZfqTmcGR5kDJg2/Lrdsj9NbNqEAh:ksd51t8UEH2PqjTfH5ZrcTvcGbYzqZfO","tlshash":"e8f409cc7191b471539361f6406f010bf33e6969680d8168f269e8e57cb998ea33bf78","first_seen":"2025-11-02T03:36:46.640177Z","last_seen":"2026-05-16T14:02:24.27748Z","times_seen":7,"resource_available":true,"data":null}},"time_used":639,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/226618464330c99b64fcaf1d7142c1e7.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/226618464330c99b64fcaf1d7142c1e7.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 51804\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fba75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51804,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 51804, version 1.6619","md5":"31998ca8ad5176fc2bd8b24e212341a7","sha1":"18200c82cc7cbfa238e72ee0b72556bf0252195a","sha256":"83de04c44b23c9ab4d7c967a640a5f0ea26c52fba132dfbfc900b9536812566a","sha512":"8a659726f287834a840e081c2afe62e48747c434a47ca9bc85d626626f105dcaa836e66b1021fedebdbced644ee0f89f961181d605aec2469656c1995f71ef1c","ssdeep":"1536:dHpqSBTZTQBYA7uED6uMZCyskYvermd6emqar:dJqyTZTQBRaJuveK2","tlshash":"9c330245c4d7b92586b45db7e713b7ffb6915a2e10140203363846862b78feabb10f8e","first_seen":"2023-04-11T21:36:50Z","last_seen":"2026-06-13T09:13:09.135673Z","times_seen":250,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/01bb491de5070339bf99832ce44c544d.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/01bb491de5070339bf99832ce44c544d.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 52988\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fbc75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52988,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 52988, version 1.6619","md5":"2b5c03ec6426d66ce6b40948681660d7","sha1":"58bc49d8676938aa3bf97678b27cda5dd1429758","sha256":"eaf0f6b8d2eda7ead06e0532e97cd0a5507cafd8aef86bdce7ad57b107655f19","sha512":"3938bf309861ce3a38b26ca4ff2f64f331e73bbf54c0a23020734c64b61a38ab3c43b8c6068f8e7461a6bbf0133b08f584236729c44b559a5b554756e881c4e2","ssdeep":"1536:m17EVaPJccRq1sIjNWUlZWwAFnF/wNchu8dlq7tvANONWfQ:8IaPJpRqzI7np2gzlSu9Q","tlshash":"5633f25bf8932789b1c47275a56b930b221c033979affc8da1970b673bd1985a918343","first_seen":"2024-11-06T11:18:44.098926Z","last_seen":"2026-06-13T09:13:09.1042Z","times_seen":66,"resource_available":false,"data":null}},"time_used":438,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":436,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.752Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee923fe575ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":576,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":569,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/226618464330c99b64fcaf1d7142c1e7.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/226618464330c99b64fcaf1d7142c1e7.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 51804\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee955d1c75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51804,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 51804, version 1.6619","md5":"31998ca8ad5176fc2bd8b24e212341a7","sha1":"18200c82cc7cbfa238e72ee0b72556bf0252195a","sha256":"83de04c44b23c9ab4d7c967a640a5f0ea26c52fba132dfbfc900b9536812566a","sha512":"8a659726f287834a840e081c2afe62e48747c434a47ca9bc85d626626f105dcaa836e66b1021fedebdbced644ee0f89f961181d605aec2469656c1995f71ef1c","ssdeep":"1536:dHpqSBTZTQBYA7uED6uMZCyskYvermd6emqar:dJqyTZTQBRaJuveK2","tlshash":"9c330245c4d7b92586b45db7e713b7ffb6915a2e10140203363846862b78feabb10f8e","first_seen":"2023-04-11T21:36:50Z","last_seen":"2026-06-13T09:13:09.135673Z","times_seen":250,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e4975ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee961e6675ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/8dd0cb1e0979d988.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /8dd0cb1e0979d988.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90cd5475ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2425,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2362)","md5":"11207086ed092faf0cff51714b98618b","sha1":"0d830c39ec694c42fab885227c4ba605c432853c","sha256":"d8527fdea3b22a6f934745edfcb1163f34b455f805ea031bb9c6f8ab1c46cc3a","sha512":"29b9141ce5e92ee00d6ee2c178dc320049abe20138da1b6f63e4f0acd4afb202ce87e219d7da4835819187c7fe6190db6d8f848a8076e10d7b4f9072cada63ff","ssdeep":"","tlshash":"404164a9a5e072748372f238cad23b4c0a3ec027947b56dfb524a63ccdca67d1d31428","first_seen":"2024-12-08T20:22:38.09685Z","last_seen":"2026-06-08T01:55:19.880696Z","times_seen":53,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/9ad40ed84eca5867.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /9ad40ed84eca5867.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90dd7875ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9678,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1803)","md5":"80d5471bfc886b30f15c1a478c9cba43","sha1":"83a363278e2410005c8197b7266b57a1b71e485f","sha256":"ea561cee9c5794111d57be8639614cac892026937d318313423e750ab1d016e2","sha512":"8f02e58dfdb9750da4e64a44ffe0a05aec28921747f58c2444d3b8e99f4134bdb6022eda354f467ab687eee459222bef0bc825f9fdbdbe8539ff8d29b0566859","ssdeep":"192:68JNpCo+jovOYPz9BDVzGGAiOR/mzKSZFw+eNyuUK8hiC4fbSqU3G2W:68JNcoXZVdAiORuzKCw+eslH3G2W","tlshash":"f8120a18b23670568137ece5d07b162fa629b814b10ce8dcb259dde9a1745a33379f3c","first_seen":"2026-03-20T18:56:02.19998Z","last_seen":"2026-03-20T20:07:30.759766Z","times_seen":2,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/_footer?lang=en-US","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /_footer?lang=en-US HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: text/html\r\ncache-control: public, max-age=604800, immutable\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee918e9275ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18340,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (2437)","md5":"d811ec3de9ac080fc67fd73f524772b5","sha1":"75f20e5a37924b0549cd572e67c184a0cc906d8a","sha256":"dc0a7e2e1c3d2ac8ad8143e21d8c76902e2b284dfaa1e368eca5329f77d908ad","sha512":"5a222797d993c8497bbc348ec99adf8f2af45db3e49576c0e22979363fff20c371fc43fd6062aa49f01082ce712e70256a09c42ff36e41b40c6d6d1c4e04c685","ssdeep":"192:73Xvn49EYidpk/4+M4RpScLF00x7qwaDBVxArRoLSN69EUHSN69E9LydZ4KEI0Af:CFSj2liw9XG67Uw6v/VCU","tlshash":"8182d89eaaf30119788bd98dfbe76358373ac003da15cdbab6cc135a4fc346448567a4","first_seen":"2025-11-12T00:34:06.973874Z","last_seen":"2026-06-01T18:42:29.337941Z","times_seen":132,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":70,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe2375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/images/b46630e470f4040eba7033cf2435edce.woff","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /images/b46630e470f4040eba7033cf2435edce.woff HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/e1fff9e3eee027c6.ltr.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1136\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee909d0775ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1136,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format, CFF, length 1136, version 1.0","md5":"b46630e470f4040eba7033cf2435edce","sha1":"ba26d2e1dc5bbc01a80446ac65bffb991953764a","sha256":"3e32aea52247a81c38b4735e84a28ba27b0cbc33f007a1d14e81e64ba766eadd","sha512":"eff809cc87517f9048f1c7a16561ef6f956ed0fe50b3382afaf111b6f159e769dd88af0dc0d8a03b748d407c5c554789b6148a137ac700f776a260fd153c0ae7","ssdeep":"","tlshash":"6321b6a2ea60c260dc4506707ae89bee732490ce2657be851e6b043bb48a304e380066","first_seen":"2023-04-08T14:15:10Z","last_seen":"2026-06-13T12:59:48.812662Z","times_seen":3293,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":345,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/2596d93acdcc228a.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /2596d93acdcc228a.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90ad2075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16509,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1087)","md5":"be21111843cacfa4de8ab73603a8e4d8","sha1":"9904ea0be9356c4c98b15e0eca029127a537433c","sha256":"ed4bbbb46e91801a41b1b0ecfffc5cdbbe0c737b9e9ea1edcc439f82bbe48ee6","sha512":"be6315fd9b770818dec7cde11fc71779b9f3ec276053e3d6223e14539b16b6dfa66beff5b64ac788aba0a71b3a5ac839c2032d057067e236215c7d1a41bbd398","ssdeep":"384:7VJNKF0Vbvob3yAqp9LKF0lE1Vx7USYlut8t8/Pvpq6ZNxwX7Ql7qoQW2RRhiipb:7ZKF0VDob3wpYKE1VKSYluGt8/DZDQ8y","tlshash":"7972e708754b749bc6b2f8e8007f1095f8b99d01f00c9cf6bda9e8c2ac25c4951bb7b8","first_seen":"2026-03-20T18:56:02.202758Z","last_seen":"2026-03-20T20:07:30.743209Z","times_seen":2,"resource_available":true,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/2a394861abd07a6d.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /2a394861abd07a6d.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd4075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10347,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (721)","md5":"4e3ea90a3973fd092730f96c0da35743","sha1":"97f05fd4c491458008ed31d5e8ac70b66822455d","sha256":"51bb98921ca7fe7c8fdeff0be0576b177cd5bc18217640f1826b76609ab7f8d1","sha512":"19f1f3d969e7cf62cfae23c675abd360235986cd81f729f1581242ff1e4e5e107d11140d6bb2283305ae68b042eedf92c1bdf11a143226b6c3d2b298362a563a","ssdeep":"192:qhJo2DnU8xHK+qZNeuqipqImO4mzx1n6Sy7Q5Y5+5S6zju2cC7AyR4D0nQuDkuC/:qhJoUnU8ZaZnfRP4U7XVX5nzkj20","tlshash":"2a22d748bb87a45b4777a8a4407f00a1ed1d3a18b04cacddfa6bd4e3a525c74523eb70","first_seen":"2026-03-20T18:56:02.20437Z","last_seen":"2026-03-20T20:07:30.752073Z","times_seen":2,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/4ce3dc17acb5c45d.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /4ce3dc17acb5c45d.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90dd7d75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29625,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2587)","md5":"c9fb3d2e27198c5decb93e6e31e421e1","sha1":"ed6e6fe7cb6e892bca2dfa4d3745118d96070c1b","sha256":"7b274ff65fb57d01fd6ca043d5b7cb39a10cd94cfc1ca693dd65628d8e822ce6","sha512":"e70cddd85682002ce6ec955a8423b671cbabdc0bfcdfaca9441ec2b41dc81133a984047e0ebfed949eae9872fbb8d86d36bc6f418fc2af6cc5f60430a72d90dd","ssdeep":"768:M7e0auEFoY4BeENoiqBI/dfwhRGx0JC5gRk1NFcN3r5w6UTBCIL5n5EWUS2rmAGJ:Ee3TaykfwcUwCdS2c6CR","tlshash":"abd21848b6db605597b3c9a1903f1115a12c7f39f408c8e4e22eddea2858e4e7279b3d","first_seen":"2026-03-20T18:56:02.20625Z","last_seen":"2026-03-20T20:07:30.757205Z","times_seen":2,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/01bb491de5070339bf99832ce44c544d.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/01bb491de5070339bf99832ce44c544d.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 52988\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee954cff75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52988,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 52988, version 1.6619","md5":"2b5c03ec6426d66ce6b40948681660d7","sha1":"58bc49d8676938aa3bf97678b27cda5dd1429758","sha256":"eaf0f6b8d2eda7ead06e0532e97cd0a5507cafd8aef86bdce7ad57b107655f19","sha512":"3938bf309861ce3a38b26ca4ff2f64f331e73bbf54c0a23020734c64b61a38ab3c43b8c6068f8e7461a6bbf0133b08f584236729c44b559a5b554756e881c4e2","ssdeep":"1536:m17EVaPJccRq1sIjNWUlZWwAFnF/wNchu8dlq7tvANONWfQ:8IaPJpRqzI7np2gzlSu9Q","tlshash":"5633f25bf8932789b1c47275a56b930b221c033979affc8da1970b673bd1985a918343","first_seen":"2024-11-06T11:18:44.098926Z","last_seen":"2026-06-13T09:13:09.1042Z","times_seen":66,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/01bb491de5070339bf99832ce44c544d.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/01bb491de5070339bf99832ce44c544d.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 52988\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee954d0775ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52988,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 52988, version 1.6619","md5":"2b5c03ec6426d66ce6b40948681660d7","sha1":"58bc49d8676938aa3bf97678b27cda5dd1429758","sha256":"eaf0f6b8d2eda7ead06e0532e97cd0a5507cafd8aef86bdce7ad57b107655f19","sha512":"3938bf309861ce3a38b26ca4ff2f64f331e73bbf54c0a23020734c64b61a38ab3c43b8c6068f8e7461a6bbf0133b08f584236729c44b559a5b554756e881c4e2","ssdeep":"1536:m17EVaPJccRq1sIjNWUlZWwAFnF/wNchu8dlq7tvANONWfQ:8IaPJpRqzI7np2gzlSu9Q","tlshash":"5633f25bf8932789b1c47275a56b930b221c033979affc8da1970b673bd1985a918343","first_seen":"2024-11-06T11:18:44.098926Z","last_seen":"2026-06-13T09:13:09.1042Z","times_seen":66,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e6075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/01942c595a301567.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /01942c595a301567.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90cd5975ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13741,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3631)","md5":"081c01724b06f106ac9b1cdb33cd1d50","sha1":"4f7df521113a188aa5afd1c1d6a5ef8a0b2e19d7","sha256":"97903d769cfde98d70d8e00456deb56fba1f4987108559e684e5efc8de619b89","sha512":"8c5d84aaffae54ae9bc22f35011018cf88bf42981dd786e9a51a91c5f74d9a8e4df030320e9afece52a58541f64f49ba00f1945a2c98f48877e1370b647bfc15","ssdeep":"384:cUJsBvOAci86tCIA8yOLKCKF20j0jPF2ju3fc4Qe2Z:c9vOi86tCroBj2u3ffQh","tlshash":"85520a84b699b56ca1b398e4c43f4092f21e5a50f44cc4ddb9bdfde9b8a4801e623f74","first_seen":"2026-03-20T18:56:02.208053Z","last_seen":"2026-03-20T20:07:30.758951Z","times_seen":2,"resource_available":true,"data":null}},"time_used":408,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":408,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/a26fb2e545ea4d91b9808446bd10482b.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/a26fb2e545ea4d91b9808446bd10482b.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 65948\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fa775ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65948,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 65948, version 3.66","md5":"9df22788857e12d64e2eabe7ac70a1a5","sha1":"770a16d474ab4516639762398f10708130009eef","sha256":"c1a0b3b79debaec3ccbc9d048db3fe3d66800ad083f82ad806b3fff64e5ef55b","sha512":"b13206b7957fdcff66403d4f7c5973606287e71b334992196c51e864372cdacf84b7a363617f3b826e845fc70a3946fcd4d47c1676e2bf6804736c45b2999bfd","ssdeep":"1536:K4dhnjX/P21fjebn22gaLZop/+l23CoVEp7nMiRpJBWeTJ:znj21fjerrIkoZYLMifJB1J","tlshash":"ab53013cd819ec0dc092d834ec7c60503e479fbf02ba91b625a4766d0d5a1cb78ab67b","first_seen":"2024-11-06T11:18:44.072656Z","last_seen":"2026-06-12T08:34:56.82453Z","times_seen":43,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49716\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee954d0175ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49716,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49716, version 1.6619","md5":"79ea29a02fa94f145245e709cb13dbcc","sha1":"406606b262809a1ed147c578938808abe688df43","sha256":"79a4f67f95a221586446b94871e770c31e46b3a22482b5803bca71c45f878af1","sha512":"088a1486bf0836b3a9568d084e1dcf10e2f8be6e2226078041fca5bc941e19a4277e7fec4d9a7e218916449fa7c349cdde3b2d8c54ad27847ca25c9d28e53496","ssdeep":"768:1byN4KzK7Uu5Bov/TVvV9nDXJcU81+iTTX1LeHp1NRBe/n2SphF+TJfGnndEwEq0:1v/5WTDZcPMiH1LejY2SpOfiuvqjpG","tlshash":"c3230160f7746ec3e0a4d52e0b24acac627070e0fbece9f8555ba0fbb355164328e506","first_seen":"2024-11-06T11:18:44.064214Z","last_seen":"2026-06-13T09:13:09.118136Z","times_seen":39,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/a26fb2e545ea4d91b9808446bd10482b.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/a26fb2e545ea4d91b9808446bd10482b.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 65948\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee956d3c75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65948,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 65948, version 3.66","md5":"9df22788857e12d64e2eabe7ac70a1a5","sha1":"770a16d474ab4516639762398f10708130009eef","sha256":"c1a0b3b79debaec3ccbc9d048db3fe3d66800ad083f82ad806b3fff64e5ef55b","sha512":"b13206b7957fdcff66403d4f7c5973606287e71b334992196c51e864372cdacf84b7a363617f3b826e845fc70a3946fcd4d47c1676e2bf6804736c45b2999bfd","ssdeep":"1536:K4dhnjX/P21fjebn22gaLZop/+l23CoVEp7nMiRpJBWeTJ:znj21fjerrIkoZYLMifJB1J","tlshash":"ab53013cd819ec0dc092d834ec7c60503e479fbf02ba91b625a4766d0d5a1cb78ab67b","first_seen":"2024-11-06T11:18:44.072656Z","last_seen":"2026-06-12T08:34:56.82453Z","times_seen":43,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe2a75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee961e6b75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49716\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee955d1575ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49716,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49716, version 1.6619","md5":"79ea29a02fa94f145245e709cb13dbcc","sha1":"406606b262809a1ed147c578938808abe688df43","sha256":"79a4f67f95a221586446b94871e770c31e46b3a22482b5803bca71c45f878af1","sha512":"088a1486bf0836b3a9568d084e1dcf10e2f8be6e2226078041fca5bc941e19a4277e7fec4d9a7e218916449fa7c349cdde3b2d8c54ad27847ca25c9d28e53496","ssdeep":"768:1byN4KzK7Uu5Bov/TVvV9nDXJcU81+iTTX1LeHp1NRBe/n2SphF+TJfGnndEwEq0:1v/5WTDZcPMiH1LejY2SpOfiuvqjpG","tlshash":"c3230160f7746ec3e0a4d52e0b24acac627070e0fbece9f8555ba0fbb355164328e506","first_seen":"2024-11-06T11:18:44.064214Z","last_seen":"2026-06-13T09:13:09.118136Z","times_seen":39,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/d0cfc50bd9a7e968.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /d0cfc50bd9a7e968.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90ad1f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42572,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3114)","md5":"2d7b6169e6e4ca5e810fa2ee7e067679","sha1":"48b4f08ab35a9d73040e6930ca51b830d696aca3","sha256":"5f545d14c5fdc7442889a74c32c04da51316116b212d1277d5f32870df7406b2","sha512":"87094302a0ce9e98aa7efc24d750667f6755dc261c0829890b702bc5ef4c5579a4e4cbb6643c6a9334cf5df0bc87b9eebc2c6920f31684fd6c19e0864f6a276c","ssdeep":"768:dBWU87GGi+cm7ggclMac6/W10TgRYXSrV/tTyWwe08GtKVaOeAXyXJA/rgWPASZB:3sG+cm72l+8XSZ0SCAzTV","tlshash":"0a13094976c7626386b3a4d1703b8586a8b53f32f04eacf4b646c1f0782ac14d7b7766","first_seen":"2026-03-20T18:56:02.211875Z","last_seen":"2026-03-20T20:07:30.755665Z","times_seen":2,"resource_available":true,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e4f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/static_font_4.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /static_font_4.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee877e4d75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1506,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1446)","md5":"d1437e0251d431b3a3080cb68d66c610","sha1":"e40f425d2630e3d7c770d913457b1209b7b81327","sha256":"138b5385f644aacbff65a59c31cdd4f12856f422ebf852afb7477230e9e002c8","sha512":"31045fca87d9d8f7c5015713d8a1d74e6f179524727855c1d488a644133d876ea2e9bcec8ab1fd1d253b1cccafec599d743b5a402f727af6825a50673f8d5d5e","ssdeep":"","tlshash":"4131ac341419918ed862795334df76721f3e10256f88622bdf1c58944fabca6f150f9e","first_seen":"2024-08-20T09:48:06.054128Z","last_seen":"2026-06-13T10:22:10.934616Z","times_seen":2190,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/6c7d23e087795044.strings.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /6c7d23e087795044.strings.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90ad1d75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4317,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3999)","md5":"1f227bcee40a4324ff1b01792affc455","sha1":"097083fcfb30029c5e46b4a25e55206803d3347d","sha256":"1d0a9898dc268701222ab4b0714d86adb7652ab6f8ff68c1bb6eab3e08391fd5","sha512":"a6e4e731d4db1204243ef0bedb9df442d1ebe5df44cb137cbab3183c999cc98747a64191c4992f1cbcf0b3c37e6ef511c8a66508844a0cbe87e0bba815125efb","ssdeep":"96:bytVoHXnxWpyo034Nf+qzNoBvv37Pqy4+54W97fHaoG:GtVo3xWYo0INfZq5v7P9B5h7ZG","tlshash":"df9131350742d20cccdb9a484ab83de4716ac4d5b6533739fd6ac0ad52cbc78be8da48","first_seen":"2026-03-20T18:56:02.214635Z","last_seen":"2026-03-20T20:07:30.775711Z","times_seen":2,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/3caeb8725430f400cbc24c4707d72558.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/3caeb8725430f400cbc24c4707d72558.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49844\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee956d2875ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49844,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49844, version 1.6619","md5":"a48bdde62d1cae0a328f7c19af70e644","sha1":"1b9853a5898ab3f285136346420e416d492bc556","sha256":"88067508265443d9744ae0cc1bcf7448b443ba4d22c8b24c03879b9cbb5f51db","sha512":"9816495f16e850e7e27f2f09ad55680fa9b50ef066e3899c5ad1816e0b84550e80ea24d970f6f0ba08e4e4c181be7db3de3dbb9fd3764dacf9be3d82bed2ef76","ssdeep":"768:nxE+avl8OFpsL2RqBB6SVhEtxw90TXbMGdNuH4Lo2fbZ/Ao2CMwTD0AbIu:nxdavlHaLQqBBeLw9owjmp0Iv","tlshash":"b123025f98dc3216fa8317582705525f5b1b60668abef8c88c0db7ec05356b6239cdec","first_seen":"2024-11-06T11:18:44.048508Z","last_seen":"2026-06-13T09:13:09.112585Z","times_seen":61,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/images/e53c4bd8da5e491d9ab09e7cf0daf874.png","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /images/e53c4bd8da5e491d9ab09e7cf0daf874.png HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: image/png\r\ncontent-length: 5971\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95cddf75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5971,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"001d04d8ffff08f82d461fe590aa5616","sha1":"9a777f2dd6d963c8b385e118e7127c1403a6dfd4","sha256":"dc823dfb52c77818de9bd6eedcebd92839aee78ca4580a108b1ecda2f7bf64cf","sha512":"b3ce5cdf0ecd94d0e689c24c4f16d9148e7c04a8d78faa622e4b663c29a661a72db3038d65057ea438a603cfc7a109ca746d76a0718e8f3203065d7c541e4234","ssdeep":"96:9MQp/qSMCAHsS5AxLqiX6IbvYeinhgvIy0tTVAhaSIfcdBZ5r+G:Jp/qlHH4LlKuALMR0tTVAh+fcdR+G","tlshash":"d2c18e5b382eb1c7dad467fe03aea0aac5375d4b7608e9913d4276bc5361c543208a0b","first_seen":"2024-12-09T21:44:15.849099Z","last_seen":"2026-06-13T10:22:10.970733Z","times_seen":1037,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/media/fd93ec24fe3c257f2b2bfb6c1233cc53.png","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /media/fd93ec24fe3c257f2b2bfb6c1233cc53.png HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 78014\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee987acd75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1345 x 745, 8-bit/color RGB, non-interlaced","md5":"119d95fcabc18ad80e6ccdeed1fc88c1","sha1":"fe610a315e9397e5a3463943b803cda3d4fea62a","sha256":"5f46da58a097976f7384fe36511a9c82317fc7f0605ec35451fc2ee66d7582cc","sha512":"9d9908559fd2e508f96d4c6342cb8538981a6b0d1a77d0e27c6e24e3e7d056026c2e18ac91413bc4e1016e1d5eab5e5a8fbac27bd0f2fa8c6b3068ecad8d7a31","ssdeep":"1536:8IU5DqhPbPAPJHN6ARktSeUDQM/4bX+y27TlRmItk:8IU5D0DohNvRktSeSQMjHlPtk","tlshash":"2d73f04a9325df7cecd499f5b3fc29196f6b2c2b28887e8fe5493655e03677400d0892","first_seen":"2026-03-20T18:56:02.22041Z","last_seen":"2026-03-20T20:07:30.761626Z","times_seen":2,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":453,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/b1d2a261e5c9ab06.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.487Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /b1d2a261e5c9ab06.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee909cf975ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1450)","md5":"65467e117fbfce7f25ed1acadf0ad646","sha1":"bdd1bd3b67b35f9ef2953d4613b1e232035101ae","sha256":"614a9385aea57ccb9c812728e264980b4475bac4f83a9e8e5f5206873b3c3930","sha512":"8d701709fa3af582c97d1a23c483481ee9fd6edebc3dd92e555f9b06ee7c9bc1455945ed0484ce7da63ea46d1a75c83ea611d5ab59acf28ac57e7a4f9eeef261","ssdeep":"","tlshash":"b9416648364eb878d5b614e8101f1159a602c752f10cfda9b836ccfaf1f4e51a771e3a","first_seen":"2026-03-20T18:56:02.222192Z","last_seen":"2026-03-20T20:07:30.763486Z","times_seen":2,"resource_available":true,"data":null}},"time_used":352,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":352,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/44f10781a34b80cc.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /44f10781a34b80cc.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90cd4f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38495,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5218)","md5":"6f7b8a1397737484d13a3379773a74ae","sha1":"c4e931a370266b4ee214fce549ec9c70344acd7c","sha256":"a438d87a5c21d7db5abfa5052557d3858db8ae569635e9480e1cb03b07da0e56","sha512":"188d16419e017a4b80afe16456bfdb8402a95ce02dad3fb686ecce0b76a2f208279844fbaae03d2ec52080248d34adcab6923da0b955353a2837a3629a181c57","ssdeep":"768:iNHaG7VinkfNseI2IJmzBENlsxBN9eKNP5vF3L0O7xgUtm5B472lDPZIL7f+JaXs:0No0xxRVFYOeUszla7EaZ691FY3bbrNI","tlshash":"24033a6572a6f07da123c9e0c13f5115622f7458b00cc8ecb5bd8de9685a4caf12bfb9","first_seen":"2026-03-20T18:56:02.224007Z","last_seen":"2026-03-20T20:07:30.765903Z","times_seen":2,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/e532966f486645f74efaf7432e1d01c2.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/e532966f486645f74efaf7432e1d01c2.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 53924\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee956d2e75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53924,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 53924, version 1.6619","md5":"a2a53322a15163aeaafc3bd1040abcbb","sha1":"4dc7dd5f0ea7794eabf9c19881757a5e7f18c6eb","sha256":"9a05a6e7d4bd726dd7d691fd89a0c5c97203c94786469583079ac5e67d0bc26d","sha512":"6da77e08109c406be73137d28ebbdb661e336fbed839c6bc48c547ba8abe138c4d802a194b5f9a928e10acd3e5e630db7dad4d4a629b5f7ce8f6584be7efc75e","ssdeep":"1536:BGv3AlxAZVCJP0zuE0sQMBrLcKeWmBDmh4dt6lEHYk:BGPGxAZVCJWuEpQoUDW5SP","tlshash":"773302bafe294e1cd39f9415011cb6cdf93a9b64dac98173303f498f6b158c79a211a3","first_seen":"2023-04-11T21:36:50Z","last_seen":"2026-06-13T09:13:09.108099Z","times_seen":191,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e5a75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee961e7375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/3caeb8725430f400cbc24c4707d72558.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.741Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/3caeb8725430f400cbc24c4707d72558.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49844\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fb375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49844,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49844, version 1.6619","md5":"a48bdde62d1cae0a328f7c19af70e644","sha1":"1b9853a5898ab3f285136346420e416d492bc556","sha256":"88067508265443d9744ae0cc1bcf7448b443ba4d22c8b24c03879b9cbb5f51db","sha512":"9816495f16e850e7e27f2f09ad55680fa9b50ef066e3899c5ad1816e0b84550e80ea24d970f6f0ba08e4e4c181be7db3de3dbb9fd3764dacf9be3d82bed2ef76","ssdeep":"768:nxE+avl8OFpsL2RqBB6SVhEtxw90TXbMGdNuH4Lo2fbZ/Ao2CMwTD0AbIu:nxdavlHaLQqBBeLw9owjmp0Iv","tlshash":"b123025f98dc3216fa8317582705525f5b1b60668abef8c88c0db7ec05356b6239cdec","first_seen":"2024-11-06T11:18:44.048508Z","last_seen":"2026-06-13T09:13:09.112585Z","times_seen":61,"resource_available":false,"data":null}},"time_used":444,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":442,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/images/e53c4bd8da5e491d9ab09e7cf0daf874.png","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /images/e53c4bd8da5e491d9ab09e7cf0daf874.png HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: image/png\r\ncontent-length: 5971\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95cde375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5971,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"001d04d8ffff08f82d461fe590aa5616","sha1":"9a777f2dd6d963c8b385e118e7127c1403a6dfd4","sha256":"dc823dfb52c77818de9bd6eedcebd92839aee78ca4580a108b1ecda2f7bf64cf","sha512":"b3ce5cdf0ecd94d0e689c24c4f16d9148e7c04a8d78faa622e4b663c29a661a72db3038d65057ea438a603cfc7a109ca746d76a0718e8f3203065d7c541e4234","ssdeep":"96:9MQp/qSMCAHsS5AxLqiX6IbvYeinhgvIy0tTVAhaSIfcdBZ5r+G:Jp/qlHH4LlKuALMR0tTVAh+fcdR+G","tlshash":"d2c18e5b382eb1c7dad467fe03aea0aac5375d4b7608e9913d4276bc5361c543208a0b","first_seen":"2024-12-09T21:44:15.849099Z","last_seen":"2026-06-13T10:22:10.970733Z","times_seen":1037,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e5f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/a0684b0780c739e9.vendor.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /a0684b0780c739e9.vendor.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee877e4875ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10359,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10099)","md5":"4eb0cc037aa215c5fa2eb3c1b342613d","sha1":"97d135c19209077c0335065f35d53fffc62caa88","sha256":"e8fb139770ec251e750403322d40db96c027b9feb48f4489b76a735f9f0869e5","sha512":"270302a621dd93de4ca144dab5f699270b2dcde0e759fbd63098b09d2c597cf9a07827b8caf40343e38d3108c8cbf1edef6af44e6944fa0bd99d8467a5d2dd56","ssdeep":"192:FFS+oMcpO2BMKGwLsreI0keXg6moYyfJWh:S+oMz2BMKGwLsreI0keXg6moYkQ","tlshash":"9022af6a3f57307f8393857ff042aae150c9e396a0e98515f0a5ef0429db4e5921af3c","first_seen":"2024-04-10T03:14:53Z","last_seen":"2026-06-13T12:59:48.977236Z","times_seen":2462,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95ee1875ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe3975ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/a1201a4daafdda7f.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /a1201a4daafdda7f.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd4775ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52288,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1719)","md5":"d880a538ef87aca0a57154d7426ff8e9","sha1":"9d87eae1768409e32c1e8bcd999ded35c9252adf","sha256":"20c5fedc0a79df73d157a582336d49758714050553a7f90b1a0276b22fb67cd7","sha512":"1607c9c821c5efd09a6a151e7328b28d5b0b0431cdb794174637675b890b936b5fe946ca49613b40cad1d8af4dbf8912b3f1215d1df8109c251b38e422ff0260","ssdeep":"1536:HVclssXGYAHArPt7mUJqWbFLuoUN9eJtjulvEEH:HaaHArPt7mUJqWhLuJN92ulvb","tlshash":"6133e964f5a2b05cc676dddac07f0079b11a7e0d7209d8bcf26bd8e668946493239f38","first_seen":"2026-03-20T18:56:02.227866Z","last_seen":"2026-03-20T20:07:30.768408Z","times_seen":2,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe3f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/e1fff9e3eee027c6.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /e1fff9e3eee027c6.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee877e4c75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":129174,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6e821134fa9bdd8bb12d408e57494dff","sha1":"442b8a4c8e8ed91d4d0cb6175af60b5837d0ad81","sha256":"6a43674cc5688bb2f61692378f778b8db96ecf780ab88aa00a1e47a5c21aea41","sha512":"f346f86ca0343c1521bd1d608379e8456581eb092adaa5337f002b74799060dbf9f7034618b0c0e944f053dae73d4be82a2c8ca27e0057968cbf34e8e9a0427d","ssdeep":"768:g1bOpdiO9QBqdkap5xBYUAFnr+JfTPsG4QLFCnFCC/RF2bEvv2r9roQnkPBqUFjP:g1bo9CqdkabHJdLkf/RJQkPHjQssaPwM","tlshash":"39c33ab84a20b13cec2ba11367dc9a5c117df002ef6307ded6a5ba158ac7ffa1570658","first_seen":"2025-11-19T21:36:45.243802Z","last_seen":"2026-05-16T14:02:24.310473Z","times_seen":6,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":528,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/a75cdabbb8dcdf033cc6b207c91608bf.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49716\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fb675ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49716,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49716, version 1.6619","md5":"79ea29a02fa94f145245e709cb13dbcc","sha1":"406606b262809a1ed147c578938808abe688df43","sha256":"79a4f67f95a221586446b94871e770c31e46b3a22482b5803bca71c45f878af1","sha512":"088a1486bf0836b3a9568d084e1dcf10e2f8be6e2226078041fca5bc941e19a4277e7fec4d9a7e218916449fa7c349cdde3b2d8c54ad27847ca25c9d28e53496","ssdeep":"768:1byN4KzK7Uu5Bov/TVvV9nDXJcU81+iTTX1LeHp1NRBe/n2SphF+TJfGnndEwEq0:1v/5WTDZcPMiH1LejY2SpOfiuvqjpG","tlshash":"c3230160f7746ec3e0a4d52e0b24acac627070e0fbece9f8555ba0fbb355164328e506","first_seen":"2024-11-06T11:18:44.064214Z","last_seen":"2026-06-13T09:13:09.118136Z","times_seen":39,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe3475ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/3e11a84bbdce17d0.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /3e11a84bbdce17d0.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd3b75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6454,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1802)","md5":"56ef65c24c4d250fb5ec4e089ccd82e7","sha1":"a01dc269d9568318e779e4e7a5f6e181c6cdc4d5","sha256":"a7684614e12af4ddc04c7bfbd04cf704b2f9102d8c29e82a635f1f93497d5e58","sha512":"9ea772e302101d88778c887ce9d3e0cffad5b9a7b42065dd30377c669deca109b9f7a398b51c67d37279801d5fe71503d2603f2b9ddb8151ca84314ed9497fe4","ssdeep":"192:5nJRVZV7u6Fm1MUT0deZ2mrqhJDCTcdm2B:5nJbL7u6UTXomrqhJDCgdm2B","tlshash":"78d12a6110c91f954461d2caa49a34f45efccf1b30c8cdbae914e66ac974e8f83b6662","first_seen":"2026-03-20T18:56:02.232809Z","last_seen":"2026-03-20T20:07:30.764321Z","times_seen":2,"resource_available":true,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/420db561e59f0853.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /420db561e59f0853.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd4975ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2010,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (764)","md5":"6c7b54849183474845d31af8e53ab421","sha1":"a3c305e96680d281c1245c1e375c44bc7cc9d32f","sha256":"b6dc16f57cd801d79cdaa01f98c169571142d07373e2117dc1c0494ba0c59844","sha512":"f1e683072c1ffc41ba882389922c52e74bc1f3a09eef4e3dba20a3df8e3c92503f68dee1a91e9f45cb1582774659b64b3487a3971cdbba0f6df247345649f3bd","ssdeep":"","tlshash":"0841769878a8fc92786b20d0449f7931e62ba66370154ce0e11dec976c4d5a99336e34","first_seen":"2026-03-20T18:56:02.234656Z","last_seen":"2026-03-20T20:07:30.758119Z","times_seen":2,"resource_available":true,"data":null}},"time_used":409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":409,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/e532966f486645f74efaf7432e1d01c2.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/e532966f486645f74efaf7432e1d01c2.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 53924\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fbf75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53924,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 53924, version 1.6619","md5":"a2a53322a15163aeaafc3bd1040abcbb","sha1":"4dc7dd5f0ea7794eabf9c19881757a5e7f18c6eb","sha256":"9a05a6e7d4bd726dd7d691fd89a0c5c97203c94786469583079ac5e67d0bc26d","sha512":"6da77e08109c406be73137d28ebbdb661e336fbed839c6bc48c547ba8abe138c4d802a194b5f9a928e10acd3e5e630db7dad4d4a629b5f7ce8f6584be7efc75e","ssdeep":"1536:BGv3AlxAZVCJP0zuE0sQMBrLcKeWmBDmh4dt6lEHYk:BGPGxAZVCJWuEpQoUDW5SP","tlshash":"773302bafe294e1cd39f9415011cb6cdf93a9b64dac98173303f498f6b158c79a211a3","first_seen":"2023-04-11T21:36:50Z","last_seen":"2026-06-13T09:13:09.108099Z","times_seen":191,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":381,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/93216375a15a0334d096957c3f1f2f0f.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/93216375a15a0334d096957c3f1f2f0f.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 68352\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee956d3e75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68352,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 68352, version 3.66","md5":"c8157c9ab383cfda3198c643504100fc","sha1":"a3e6b91059b5bca2237c9cd5b080b0190f43e9d4","sha256":"579db7dd7874760fb4c62affac28bc71c396034277140da37b33d6bc79d00a28","sha512":"5ca8861b148fe7040bcec93006c3c296ac01f2346775bbf8e374bfd51653273d5a15023a3ee085f9bb5da3946037752e2c794c6cf69d4f1af98f6a8686b681bc","ssdeep":"1536:ujcjaRqlnHgTkafGjpsTBTE4qMbMD8079gNDABOdk3i9tIj:ujUDkk4Gjps9Q4qMbMX7YDABOdk3i9ts","tlshash":"4c6301c7da3d2b517a0bea14dcf0adb51d703aeaedd8a12a985c193810d2f07d013be0","first_seen":"2024-11-06T11:18:44.060494Z","last_seen":"2026-06-12T08:34:56.811652Z","times_seen":38,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee95fe2e75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/media/b25a9e7c786074bf012807138d20ba7f.png","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /media/b25a9e7c786074bf012807138d20ba7f.png HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 86254\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee987ad175ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86254,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 800 x 443, 8-bit/color RGB, non-interlaced","md5":"7d15d3f73ffba9954bb9996448afebb2","sha1":"9172f2e120bdeea620daba4b6290cc073ccb85b0","sha256":"278c50d88af919bbf7195d8965e8651fe919a19073370f6b7e4f611a40113e72","sha512":"07030d1f48cd21dea8fb3fda9eaf720c049967658803e9c7930ade3c3d98048914f464ca735a81070f45c31d94daee9c8e32813d8857b1c7872f85baa059c072","ssdeep":"1536:NN28JNBjQsEiMleA5O4AqihHX9SyHStGJBteFy0tca1U1598O:NUHmwo4heHOtuqFpWa1Ux8O","tlshash":"108312adce123fc568aeb6ad425df5fd5383430751a50b1f3e2f592091862e08a0bec5","first_seen":"2026-03-20T18:56:02.237947Z","last_seen":"2026-03-20T20:07:30.77457Z","times_seen":2,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-20T18:55:32.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:32 GMT\r\ncontent-type: text/html\r\nstrict-transport-security: max-age=31536000\r\ncontent-security-policy: frame-ancestors 'self' *.canva.com canva.com; report-uri https://csp.canva.com/_cspreport?app=websites; base-uri 'self'; object-src 'none'; script-src 'report-sample' 'strict-dynamic' 'nonce-cd49fdc1-e03e-45cf-b14f-7fc81811d0f5' 'wasm-unsafe-eval' https://www.google.com/recaptcha/api.js;\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: all\r\nvary: accept-encoding\r\nset-cookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf; HttpOnly; Secure; Path=/; Domain=canva.site; Expires=Fri, 20 Mar 2026 19:25:32 GMT\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee83cbdfdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27128,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20563)","md5":"ed47cd8c2a69838e379d94b2c862fe78","sha1":"8e1c88b85aba772fe80df61920ba089100bd43a3","sha256":"57e2207760a974adfd735fea00a63f6e20300685f245f564f58ce0cae898bf58","sha512":"7c6e3e90a3f40d7375a5a52225b5f23618bc85e6b1209265acc8e995b18cb84406007350b3b34ee55e13034620b225f68fb40a6fbcf0dde8f1a6ec45fb86ca7c","ssdeep":"768:RknbMVNp1xqXtBmVONkB4tOZ7AX8cRxgBlt+NQ2yp5VFJiX:RknQ4LGwyNiX","tlshash":"ecc2fa1a2a0526e74ac398cba143787272ac9d19b3c45541b3fbdd2c87e3ded5392317","first_seen":"2026-03-20T18:56:02.239493Z","last_seen":"2026-03-20T18:56:02.239493Z","times_seen":1,"resource_available":false,"data":null}},"time_used":501,"timings":{"blocked":31,"dns":7,"connect":1,"send":0,"wait":439,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/35e043f524cea603.it-IT.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /35e043f524cea603.it-IT.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee877e5375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":318,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"97fe24f2d90024c1ae916135dc24aaf3","sha1":"9afe504df31f46341be31273ee27ded71307c075","sha256":"2052326ef760d4e45fb7bdff461934ba389b9dfd8713cfa874aec980127cb876","sha512":"d7c6e05aa8fd79012a79b2139a21c3f0cb2b51b6b59f80e33ac40d4212ecff793b03cebdcd1a4e1ea51dde230059dfdd5ab3c6c68985c2454ce4b2f32f7119e1","ssdeep":"","tlshash":"c3e0cd760092fae8af7b0ebdd25131846815471014a2e6fc88b045a13bf5cc7cf5405d","first_seen":"2026-03-20T18:56:02.240989Z","last_seen":"2026-03-20T20:07:30.766898Z","times_seen":2,"resource_available":true,"data":null}},"time_used":346,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":346,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/1ffbbd26c29ce4f7.runtime.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /1ffbbd26c29ce4f7.runtime.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee878e5675ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23060,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (22996)","md5":"5b8dc512c921cec1a1573f0341ad9ad5","sha1":"d2c6b930b9944290bc92f14131cbb5885875e934","sha256":"3a1f1d412d4e36d7a42ce7b60aa6ea1ae953f20f43d700aa3e2fb00ae52217fd","sha512":"a89b5e89655fe3248fca49d4cf999c90f0d450de5c014720afa38a7c360c069375956dcbc3caec539653a094e793cc907fdbe5b7f526d8ffd5764613a49de93e","ssdeep":"384:bhtUox1yZm/X/blmqlIs3qJBkKf36hx9Polsm23WIJgo6IiJSVS00sa5uufhJSkW:Fa87listKf3ExBo2m2GI5biMVd0JuufK","tlshash":"51a2e5da36b21172e0f12ee8b8a6d052355d4cda30ad5a50dbdb7ce4ff50e62e433912","first_seen":"2026-03-20T18:56:02.24239Z","last_seen":"2026-03-20T20:07:30.767424Z","times_seen":2,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/118052af16110a6a.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /118052af16110a6a.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee908cf375ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":105,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"126308fa3f323f30d56ccb89f71ed06c","sha1":"3732a362d7823922e767519fda94114b1f64ff8a","sha256":"ca4fa9d0bd9ce4199150663aa1ad8d59f8e2cbd37ab76293a2d74983fb0d2ca0","sha512":"2499c0d3081bba1732ecf4d64bff34552df76ed51151efe64abeac273b14b6669ced0ed87fee27e1ce1521cde5b10c5b4cd0236a8ef8b096d1a1e7ae2dc140da","ssdeep":"","tlshash":"05b012bed8f12d6dd53357393971c05c50baa041f2d1891cb340214c93b6c019c3ad2a","first_seen":"2024-06-03T09:59:45Z","last_seen":"2026-06-08T01:55:19.880115Z","times_seen":35,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/1319be5341bf1a68.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /1319be5341bf1a68.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd4a75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2405,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2342)","md5":"f37d4679ff6e1f773b3d4f22beab5a7b","sha1":"1541c938f4947bd63c8453dc3e9c1a84b5bef57b","sha256":"1b3deb5c910ad20d9381ac27903f16ea8f4422f90149cb17a30a0866a87d0acf","sha512":"55f86517ed8c189308ee99be3c35a87a2bc3b3a607a9587024574ffc85aa45f459a4d7d373f61caa6100e9720464250118c7f1fef8d8e26a0093c0d194644837","ssdeep":"","tlshash":"664165b17e6ad13cbc2be0696bd4528d20626143ee5117ece8e4b123c6d33f90d3d644","first_seen":"2025-11-02T03:36:46.657119Z","last_seen":"2026-03-20T20:07:30.756613Z","times_seen":3,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/93216375a15a0334d096957c3f1f2f0f.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/93216375a15a0334d096957c3f1f2f0f.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 68352\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fc075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68352,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 68352, version 3.66","md5":"c8157c9ab383cfda3198c643504100fc","sha1":"a3e6b91059b5bca2237c9cd5b080b0190f43e9d4","sha256":"579db7dd7874760fb4c62affac28bc71c396034277140da37b33d6bc79d00a28","sha512":"5ca8861b148fe7040bcec93006c3c296ac01f2346775bbf8e374bfd51653273d5a15023a3ee085f9bb5da3946037752e2c794c6cf69d4f1af98f6a8686b681bc","ssdeep":"1536:ujcjaRqlnHgTkafGjpsTBTE4qMbMD8079gNDABOdk3i9tIj:ujUDkk4Gjps9Q4qMbMX7YDABOdk3i9ts","tlshash":"4c6301c7da3d2b517a0bea14dcf0adb51d703aeaedd8a12a985c193810d2f07d013be0","first_seen":"2024-11-06T11:18:44.060494Z","last_seen":"2026-06-12T08:34:56.811652Z","times_seen":38,"resource_available":false,"data":null}},"time_used":490,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":488,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e4175ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/f8f199f09526f79e87644ed227e0f651.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/f8f199f09526f79e87644ed227e0f651.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 194188\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee960e5275ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 194188, version 1.15139","md5":"654ba7fa32ccfd8c24e11f29b7156a34","sha1":"e793cfc8775a34158f6c2e2b9b4f8aa9dd3b42d4","sha256":"c2d36a5db423d0a4a5d3a8e16e65b1e5384e476cad41c41d3e3af2622cda5813","sha512":"77f1f87ee469d7786865a7224bc026e8eaf2dd5ba6d6bf6eb9716d68f80f2a0ad4d8961fca25dfd6c5797cd37f33fdef3e3162a99154aa9e5b103fcac6ca7057","ssdeep":"3072:2DB+LuV+P1oE5jssrK+hXI4LLYJwGDU5yFCmoBV+pFtUDLXyKcTkI6ocSJ5mmD0Q:2FsuVnds+iXI4XYiB7BgULXTcT1WSJ5H","tlshash":"dd14132c295b96e481d786a35b0d07d6cca750a5c8defd34576a7d42e1d8f0f830e328","first_seen":"2023-05-11T10:14:27Z","last_seen":"2026-06-13T10:22:10.844281Z","times_seen":1113,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/59453774ec5ccf66.strings.js","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:33.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /59453774ec5ccf66.strings.js HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:33 GMT\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee877e5075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7050,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6717)","md5":"ee7762db0c78b7a08702ab5c476c3496","sha1":"7a9cc04a2af275c326f37a2fec9d4c2cc5403a3b","sha256":"00f4df7d4576a43853f8bb1adae4eea417cb6c5ce0b1e2a0b71dabf15ec923a6","sha512":"787abbd2c0b5a6b8b831b111e69a4b67601a59566533e51ad14a08f0783a6e2e1f9c08644641b3234fd207aa67238bbe6075d6bada2ae6382150a9c46c75e6ef","ssdeep":"192:bgx2UKPCmggO5K2uTKoTdMWeSxOXI7K1zkFYFyZw5GKhg/xG:bJLHggOc2foTdMbSkXLdkFIy67hy8","tlshash":"87e1a520d581e00cce650e5f563eada4f1c7c1d97b9a3675feadc23c21c75789a60449","first_seen":"2026-03-20T18:56:02.24614Z","last_seen":"2026-03-20T20:07:30.77045Z","times_seen":2,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/254ae85d7010e883.ltr.css","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /254ae85d7010e883.ltr.css HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:34 GMT\r\ncontent-type: text/css\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9df6ee90bd4275ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4934,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4871)","md5":"2d8e63b4f6f918840ceee039d6acd6d4","sha1":"1a863cf9c0f26e75e4e971f6bee8618bf59dd037","sha256":"a8cf0b68e6e617bff942078a86a1f3e83c0813ac6377a0fd8f50f78bcbcd7c99","sha512":"bc8d7b32b8d8dcba769dae84af32871c44eacb26c82e304ee0f0c7911e8ca4d16f1807c90932b03ecc23a67d5844d2cec6bb7694f0f17082975e6d6caa985299","ssdeep":"96:+yWP4tk2pl6NMrJaNOXN8NOcq6zEp7j0Jdz2DynpNR0Z:+Xgt5+NCJaNOXN8NOcBQjZD4pK","tlshash":"52a1a574476076f926279a26f6a09f8800b11052db2b03dcf9a0fa95c1c317d3aab98d","first_seen":"2025-09-30T15:00:50.774274Z","last_seen":"2026-05-16T14:02:24.274882Z","times_seen":9,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/64dfd027222a62438bc2a4d821786c71.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:34.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/64dfd027222a62438bc2a4d821786c71.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49824\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee921fae75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49824,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49824, version 1.6619","md5":"aedd2ce08bf02843779c9d252cbce2ff","sha1":"cae5781562363332d533e165a33645042250402b","sha256":"c1822b07efe45aa95e132ec66b67f086d4d96fe795f769c098b923bfc8ba58d6","sha512":"169cf03ddd8c9ed3f62bd20f35b42870bff28f9dda868f9c82819e24fe6a0d86c4fd3705e92886bf8fe7a7cfecd57bd0f5eb9cea2a942a4379e0536ded109c68","ssdeep":"768:Y4l58Vqf3jJsvz+92smqYB21hivVDEhF6HyBMxgb/VLv1NaQgjJ9BALF:YVVmjGvi9mHB2LYDeFi0/VP0JbI","tlshash":"9923f1e1861dbbe1f2dc12f91d098b23f7c1e0d1c25ba0d5abc50d4e6f77ab28864684","first_seen":"2024-11-06T11:18:44.038295Z","last_seen":"2026-06-13T09:13:09.117606Z","times_seen":57,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/fonts/64dfd027222a62438bc2a4d821786c71.woff2","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /fonts/64dfd027222a62438bc2a4d821786c71.woff2 HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 49824\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee956d3075ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49824,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 49824, version 1.6619","md5":"aedd2ce08bf02843779c9d252cbce2ff","sha1":"cae5781562363332d533e165a33645042250402b","sha256":"c1822b07efe45aa95e132ec66b67f086d4d96fe795f769c098b923bfc8ba58d6","sha512":"169cf03ddd8c9ed3f62bd20f35b42870bff28f9dda868f9c82819e24fe6a0d86c4fd3705e92886bf8fe7a7cfecd57bd0f5eb9cea2a942a4379e0536ded109c68","ssdeep":"768:Y4l58Vqf3jJsvz+92smqYB21hivVDEhF6HyBMxgb/VLv1NaQgjJ9BALF:YVVmjGvi9mHB2LYDeFi0/VP0JbI","tlshash":"9923f1e1861dbbe1f2dc12f91d098b23f7c1e0d1c25ba0d5abc50d4e6f77ab28864684","first_seen":"2024-11-06T11:18:44.038295Z","last_seen":"2026-06-13T09:13:09.117606Z","times_seen":57,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"walletrust-ext.my.canva.site/images/87e22a62965f141aa08e93699b0b3527.jpg","fqdn":"walletrust-ext.my.canva.site","domain":"walletrust-ext.my.canva.site","tld":"my.canva.site"},"ip":{"addr":"103.169.142.250","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://walletrust-ext.my.canva.site/","date":"2026-03-20T18:55:35.806Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.canva.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 10 Mar 2026 22:56:34 GMT","end":"Mon, 08 Jun 2026 23:56:24 GMT"},"fingerprint":{"sha1":"8A:40:13:7F:F1:0D:F8:E9:53:C4:3A:BD:48:CC:31:12:56:4F:40:67","sha256":"95:6E:CC:A0:62:0A:97:30:E0:6B:43:69:BD:DB:58:E4:24:7C:69:02:AB:8F:61:21:DE:24:92:0A:C1:04:7A:90"}}},"request":{"raw":"GET /images/87e22a62965f141aa08e93699b0b3527.jpg HTTP/1.1\r\nHost: walletrust-ext.my.canva.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://walletrust-ext.my.canva.site/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=ipMHGKeX6cPOK5GdMhiWf6K8AB_fWco_TGFM6hwoFB0-1774032932.445828-1.0.1.1-QhP4mCDfmSBOdq9luz7RcS1whf7gYE_tqx3HoMBRS8FkkNBW5ljb1F6Tqwj661U6sEtw9SFiop5_zaZDKuJqRxLHENsbjxVPDnNljHOGRdbIIraIVm_EoifRrjIzclLf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 20 Mar 2026 18:55:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 14135\r\ncache-control: public, max-age=604800, immutable\r\nstrict-transport-security: max-age=31536000\r\nx-deployment-id: 1a6f365f60a97d397b3eec55e99b3e87fa6d6007d39877b39a6ab54d027ac161\r\nx-robots-tag: none\r\nvary: accept-encoding\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9df6ee98cb5e75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14135,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1438x560, components 3","md5":"a9570a9e9b0ee86f996a34717eaaa80f","sha1":"e76c3e57d109c7b7542763872aec84b4ca749d45","sha256":"84879b89770c6de248c88819697c37aacd209a075f6932b339c63dfe5fd6ab6b","sha512":"7121d17a4891676f79cfa8339d8ef7e4bea3feb90a74bcf0f85782be8ab909121e624d75f7ecf0eea3b2060c77cbe7f2e5cb8fe3ea318420610f2d3c48a8870f","ssdeep":"192:yrYaVEYBiSpH9oyuXpc7tvVnvRmIgtIQ/Y3bg9X0YUYIaAREh3YF:yrxqYBAtGTZmE9cwYIaAqIF","tlshash":"ac52a33b5bf0dc40e8260930ac45af3187c1e0d196f5918756611f6931d6af6e7bfb08","first_seen":"2023-09-22T11:25:00Z","last_seen":"2026-06-08T21:22:53.351067Z","times_seen":48,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"walletrust-ext.my.canva.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}