{"report_id":"a31652b3-866c-48a4-9968-c9467b002523","version":0,"status":"done","tags":[],"date":"2026-07-07T15:37:45Z","url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"3.104.102.7","port":0,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"final":{"url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"title":"Credential Phishing","dom":{"size":9332,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (580)","md5":"d57b7e3a4b6a4f30911199a7da8bbb1e","sha1":"0ee81e704ada8bede94ef360c8c7a06cf68cf685","sha256":"0f431d66f5d53930fd3994ef2dac99e98669e2b3e555c0048315f1eb36aaeba0","sha512":"8f3f74b81ff829c66777a3e6e2305b6bd53b9e937303cdf71ebe3a8350f686a505d70ccaa7dc8462d533ee68b7d970123ebb468d0ac5742416aa819c6fbe1661","ssdeep":"192:Z2vdM3s65CHu9Ez65QAptcibE9uHIRCblMoGwgkCquGExjtsbAORpR2RRkQfJsB3:z6Hu9Ez65QAppbE9uHIRCblMKbohsBMQ","tlshash":"8d1285524ae116ae3423d0a8b329be068070d417965aec443fff53c4dfd6bc68db2395","dom_hash":"domhashc5aaa16eb5a451033891454da4284a33","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"3.104.102.7","port":0,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-11T15:37:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"p.typekit.net","ip":{"addr":"23.33.119.26","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2010-08-02","domain_rank":4638,"first_seen":"2012-05-23T14:28:57Z","last_seen":"2026-07-06T07:48:11.351273Z","alert_count":0,"request_count":1,"received_data":338,"sent_data":546,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"healthyemployee.work","ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"domain_registered":"2016-08-31","domain_rank":0,"first_seen":"2025-12-15T14:57:53.011813Z","last_seen":"2026-07-07T12:28:06.53471Z","alert_count":15,"request_count":15,"received_data":401925,"sent_data":8535,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap:3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Adobe Fonts","description":"Adobe Fonts is a web-based service providing access to a vast library of high-quality fonts for web and print design.","website":"https://fonts.adobe.com","common_platform_enumeration":"","icon":"Adobe Fonts.svg","categories":["Font scripts"]},{"name":"Typekit","description":"Typekit is an online service which offers a subscription library of fonts.","website":"https://typekit.com","common_platform_enumeration":"","icon":"Typekit.png","categories":["Font scripts"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"use.typekit.net","ip":{"addr":"23.33.119.19","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2010-08-02","domain_rank":4054,"first_seen":"2012-07-05T01:42:39Z","last_seen":"2026-07-06T09:27:39.204263Z","alert_count":0,"request_count":1,"received_data":3125,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-05T22:22:24.069932Z","alert_count":0,"request_count":2,"received_data":890887,"sent_data":1166,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"images.pmeimg8.com","ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"domain_registered":"2016-08-31","domain_rank":7057478,"first_seen":"2017-07-20T13:54:09Z","last_seen":"2026-06-23T12:32:20.116539Z","alert_count":9,"request_count":3,"received_data":435915,"sent_data":1854,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"login.phishme.com.au","ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2017-05-13T00:22:02Z","last_seen":"2026-06-24T22:29:36.630033Z","alert_count":0,"request_count":1,"received_data":243,"sent_data":551,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-05T22:19:28.847206Z","alert_count":0,"request_count":2,"received_data":68878,"sent_data":1161,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"healthyemployee.work/javascripts/jquery-latest.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","size":88145,"data":"","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-07-14T09:56:27.955723Z","times_seen":136529,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/5cd/382/77-/original/interactive-education.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"f02a54af3d82f7e8d6c9d3483a6bcdd8","sha1":"13857b461a890ba53dfc3636ab1053cb869d1059","sha256":"d74ddf67dbd1e98dd9c737bed791e1f901f14054db745398a26b74071532a1d8","sha512":"bbc1b44cf6e27fa9474bf2c1d93247a7acbd9d5356a4e750bdcd53ae472abbcf7abb04db503ce15b4c857079e738ed2db622db214e0289cfb3c492891558047d","ssdeep":"","tlshash":"9a1125aff51a22a2617f3fe20336b11de576540f418046a1783d88f27f264456226f7c","size":894,"data":"","first_seen":"2023-11-16T22:55:39Z","last_seen":"2026-07-13T19:12:34.318098Z","times_seen":420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/358/ebf/6c-/original/cofense-quiz.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"c5860c9a3c81181e474f9bc837e70a58","sha1":"2d3f6ab4f6a9eb5f3883697a337ce63bec75a586","sha256":"ff223284d35949fdeacd2f53c6a8fc7cb0174fc1758e07556e063bf217652d58","sha512":"18d756dd8e1603868b9bf3a72514f2ce2c202bacf48dba34c665f6383611fa9d1daaaccda08d03daa5a0a7391ed1735189ea268064e9be931a41a76353a28663","ssdeep":"","tlshash":"3f613253f2c27176724b507564177623a13e8b813c442afc7c3b65c7bc6aa1ab533a78","size":3309,"data":"","first_seen":"2026-05-07T17:52:31.495654Z","last_seen":"2026-07-13T19:12:34.324819Z","times_seen":68,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/2ea/4c2/d1-/original/quiz-logic.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"1cdc981c3ad9af37f9eefbee51c6da2e","sha1":"998b1735bb3a82a6c2d84d0091ddc10144bd04c8","sha256":"edf43156fe6795519974e0635a21b4f1b34c70b7d5e844ab86b46eb3bf6d2ece","sha512":"1660e03db8b153c6879faa4e20e5491c29e4cd711d32f9ebdc505885312c070dcc794215a5272515f4f2903f43d4ddcbe447c9eed43d45707cf936d72144a5f5","ssdeep":"192:oQiOsBaLtEbizE0dui77Zh8E86PZpikiGiCil:oQiOsm2mzhci77ZhR7PZpikiGiCil","tlshash":"7e12521515290336a43367baeb5b61aeeab0491b7205f3257c3cd2941fb0c1266f3ee7","size":9303,"data":"","first_seen":"2023-11-16T22:55:40Z","last_seen":"2026-07-13T19:12:34.312556Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"341378fe58b97e31e8591f5973253a90","sha1":"77f66a92733ddc6bc381b3c96f91db3f78d5f3e6","sha256":"b8f39f699f28e62678191c5ee7b1110d7b1fdf34cd4f1cc2fe4b1127482dfbb0","sha512":"8fe13f9c089ed96272053fea21c9f3847ae84823f5459fa273c078ddfb39b92980da56529e17b1b96adf2c31658e4b32a3f78210769a59c66f147208be954428","ssdeep":"","tlshash":"abc0ccc2a2cb88ac080ec88c00a332082c38a888c80a88a08a820e3028030202aa2280","size":163,"data":"","first_seen":"2026-06-07T12:01:26.000117Z","last_seen":"2026-07-13T19:12:34.326521Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"29852a12d1d41a4211202c5813e1745e","sha1":"db83c5e25e75e1ad826269e89933dc97130cd23b","sha256":"94f34449246d7f09ed52b95b8d44a2a9a89f3e3ed64924d915a609c68c05bc9e","sha512":"f07109471b6be872f80bd76ef7ea94cc70b358cdbcd4c24f27db195c864ab49123051e6af733c5547c26d796d0139040e92457e0496daf6b6f1f67b6439912e8","ssdeep":"","tlshash":"0e21be53b8c023baa95b9222e35ebeb25631d2037464d865313f97546fe3f1022f71e5","size":1323,"data":"","first_seen":"2026-06-07T12:01:26.002722Z","last_seen":"2026-07-13T19:12:34.327567Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/javascripts/jquery.periodicalupdater.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"081c6407861490f5d4696b225ac96d23","sha1":"94174a4123b8d486d014c042219fda1c21d9bd86","sha256":"850ebab175e20015432217d462b446fd904cc7e90ae8c0339212053481163969","sha512":"91da5f44d8757434b76a9ad85b63f4ebe4797fe5f722379d8b7c75f1779e5477e3927280cf329c4b71004b78e7acffbf06c7adae2da285c0d0126c18f8d5bf7c","ssdeep":"96:4GwsdNL6Gaoj7oRenP6wN6mUbnCrc0mGMrBxS5Mli6NyzuPbCVqlmqx:dwszdo2PObzCvmGMruKs6AyPbCVqlmqx","tlshash":"a3d1404e669f054909d37068dbbf63c13b32a02b2151e5607d2e0bd08fe99a4b1f6bd9","size":6658,"data":"","first_seen":"2023-03-07T18:48:05Z","last_seen":"2026-07-13T19:12:34.310942Z","times_seen":811,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/5b8/ee7/1e-/original/jquery-latest.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-07-14T10:19:25.107522Z","times_seen":178805,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/0f7/f7c/90-/original/bootstrap-3.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"894d79839facf38d9fd672bdbe57443d","sha1":"11277f4e04cf070a350e566b053ef2215993720c","sha256":"dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2","sha512":"34fffaf69de2045e8b90adaf72c6c3d73b99bb581832ee7de1be78d34753a3ba97d3aa1b8527ec1747d25e27594e4e0a4a9104e1e7ede811ab748aa1b766842c","ssdeep":"768:K/Lx8D6XlsB92TiwZi7vu6EBI7v8vaSx4ElvhLxs7St8PsBdZsWSdA:wVGihuv8ySx4EosbyWQA","tlshash":"af7340167af921614b5b30ba8cdf614c7238901b550bd42878ad93d46f50b38a2bbffd","size":75484,"data":"","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-07-14T06:57:29.37237Z","times_seen":2778,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"17e7e8087b920180489cd3cfb581c63a","sha1":"69068d481119a5dc5c2bf2ea9cf473dd45a2ed42","sha256":"fec62a55e88967be13b79af125095b25ddd2888e1582ef7efe4e6da27ce4b47b","sha512":"08800bd4cef39a1f4266895563a1bb80f627d67499a2f67150c47eab05ca558e6138ec111743d72add7f329ac32858bf5de80d15bbb16ea071847314aed9f6f2","ssdeep":"384:YnX9B5i6iami/TiE/PEhiXS7iL3MfAk7kk2k9iriiqKmmxkwkFEnqlW0sSKFptm:YntBAjY/2E9CetOiqKmmxXiTSptm","tlshash":"cd726119158512ba36726369b6d92dc5fe61006b02117c41bbafc6646ff3da082f2ff4","size":15992,"data":"","first_seen":"2025-10-24T01:05:13.03503Z","last_seen":"2026-07-13T19:12:34.312036Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"The default language code supplied does not exist: en. Please review it. Default language set to: en","filename":"https://healthyemployee.work/system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js","line_number":286,"column_number":15},{"level":"log","text":"Detected language-specific container in the education? No","filename":"https://healthyemployee.work/system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js","line_number":150,"column_number":13},{"level":"log","text":"Education language set to: en","filename":"https://healthyemployee.work/system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js","line_number":236,"column_number":15},{"level":"log","text":"Quiz topic set to: CREDENTIAL-PHISHING","filename":"https://healthyemployee.work/system/content_files/uploads/2ea/4c2/d1-/original/quiz-logic.js","line_number":156,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/358/ebf/6c-/original/cofense-quiz.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.004Z","timestamp":1783438640004,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/358/ebf/6c-/original/cofense-quiz.min.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: hnxjzjLN5YFGhOUs6UkS4vD/fih1nFTqyJaZQNhRy4depFwrIRBgQyS96tgs5erB2hOC9BSeJas=\r\nx-amz-request-id: W850AERANC5TFWT5\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Thu, 30 Apr 2026 16:10:07 GMT\r\netag: \"c5860c9a3c81181e474f9bc837e70a58\"\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 3309\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":3309,"size_decoded":3733,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3309), with no line terminators","md5":"c5860c9a3c81181e474f9bc837e70a58","sha1":"2d3f6ab4f6a9eb5f3883697a337ce63bec75a586","sha256":"ff223284d35949fdeacd2f53c6a8fc7cb0174fc1758e07556e063bf217652d58","sha512":"18d756dd8e1603868b9bf3a72514f2ce2c202bacf48dba34c665f6383611fa9d1daaaccda08d03daa5a0a7391ed1735189ea268064e9be931a41a76353a28663","ssdeep":"","tlshash":"3f613253f2c27176724b507564177623a13e8b813c442afc7c3b65c7bc6aa1ab533a78","first_seen":"2026-05-07T17:52:31.495654Z","last_seen":"2026-07-13T19:12:34.324819Z","times_seen":68,"resource_available":true,"data":null}},"time_used":1122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/2a6/34f/ea-/original/bootstrap-3.css","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.767Z","timestamp":1783438639767,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/2a6/34f/ea-/original/bootstrap-3.css HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: AvtCP/GE8rdnS1Bpq0CrndVkf1YCMnXpq/ZWQOGqk/mC5uN2foopytDM0vQkldvpmlt66qdZsuI=\r\nx-amz-request-id: W8536P3QYR9Y5J42\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 04 Jun 2019 15:20:06 GMT\r\netag: \"86447d883f0bdb7712aed351b57eb414\"\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ncontent-length: 70675\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":70675,"size_decoded":71048,"mime_type":"text/css","magic":"ASCII text, with very long lines (540), with CRLF line terminators","md5":"86447d883f0bdb7712aed351b57eb414","sha1":"9afc2e91ef7320529792c27da58cce78c74f2057","sha256":"36067a1f96e70285a83a38ed37f99e48de0c65d8ae711549bf30e72719f2ed48","sha512":"dd992b00be30a52af74cbaf96aba328d707abb416b684f0c6c8e2f3e1bec62f06b12f0de535e0b994c81ba67f9ef3c073eaa21134173b839497f035380ae92f7","ssdeep":"384:8pzJGDs2WwvhOUAmzM23yJgp3QZY7BMx+nPRkIWMeWMDT9/kewoyS2:FOLgpA+7BMx+nCIWpWwM","tlshash":"b36386d8e71070012172cb7da3d28953bf5a10f29b199b77bef29988a30e1485a35fc7","first_seen":"2023-04-12T19:29:59Z","last_seen":"2026-07-13T19:12:34.32537Z","times_seen":663,"resource_available":false,"data":null}},"time_used":1822,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1185,"receive":637,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/10b/757/8b-/original/interactive-education-styles.css","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.769Z","timestamp":1783438639769,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/10b/757/8b-/original/interactive-education-styles.css HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: lBK08mJqz89OKm2IJVX1meH2UeWnDifQORB1hctIspTl9vUf3TeqH1T2ayA/ua2SpWUrP0X5I+s=\r\nx-amz-request-id: W851ABKQ1JG8TX85\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 07 Nov 2023 10:20:07 GMT\r\netag: \"1fbd7765c52f738599fbc6ebd5367d3e\"\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ncontent-length: 23765\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":23765,"size_decoded":24176,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"a781fac627ca6bd5284fadeca55e2653","sha1":"66361ed626d438fa8667ea7ca0bf669632d95323","sha256":"fcdc10fe19f78453eb343fe188755228db62b12a8a2ba4bfc502554a0d12d033","sha512":"a76676c6237f9d29d2fb251641cb318935a612014abe29f566f1f41067fa271194269fc4f7279e3f84cc857bac75c5d37f3ef9243b75e9e441ddcf0c982a4dc6","ssdeep":"192:hQxhtQYkQ5QfbdGAWdcMqtJ+p/rEJ9c0w0jMtZWVIvtrpcqAI8dfLPcilqzPRvt9:4qQ5QWCPFlqr5/","tlshash":"deb2fb5e9a07140f91f3cf776ba187b5eb901067da0200b9bbd973b08ff05649266e8d","first_seen":"2025-05-26T12:19:07.06785Z","last_seen":"2026-07-13T19:12:34.325968Z","times_seen":417,"resource_available":false,"data":null}},"time_used":1302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1105,"receive":197,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"use.typekit.net/wgp5bvf.css","fqdn":"use.typekit.net","domain":"typekit.net","tld":"net"},"ip":{"addr":"23.33.119.19","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.990Z","timestamp":1783438639990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"use.typekit.net","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Fri, 29 May 2026 00:00:00 GMT","end":"Sun, 13 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6D:59:E1:10:7C:04:87:2C:2B:42:9B:0B:02:BE:4A:FF:E8:09:E3:E9","sha256":"51:4C:B4:20:1D:97:45:B3:FE:50:80:99:68:E9:6C:33:8C:E3:66:B0:8E:BA:01:2F:87:14:D1:BE:86:8D:0E:73"}}},"request":{"raw":"GET /wgp5bvf.css HTTP/1.1\r\nHost: use.typekit.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains;\r\ncache-control: private, max-age=600, stale-while-revalidate=604800\r\ntiming-allow-origin: *\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\ncontent-length: 685\r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\nakamai-grn: 0.0f772117.1783438640.23fb0f6c\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2655,"size_decoded":1155,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (516)","md5":"5b2b4d6fbab2cdd0aea22a6eec758bf8","sha1":"bd4e372fc766e7fb4d1f3482633537d1fda22cd3","sha256":"7b4479cc254add429dbda33090b061f74625bd2c59d8b7fd8c314a394a7d658f","sha512":"3120cd30b0360c87f6c55c12f16713a1d99307c908620e189e9042ca3bdb3f426ea6ec6647e7e2f53293c40416c5f2b45636e9c1827e164eb6d479f9466a9b62","ssdeep":"","tlshash":"5451c0b040065de7c4d15aa2348ebbf8d45e3d6d26e4889a953288f3cc75de37310b6d","first_seen":"2026-01-07T17:29:03.770576Z","last_seen":"2026-07-13T19:12:34.313681Z","times_seen":101,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":185,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;700\u0026family=Noto+Sans+KR:wght@400;700\u0026family=Noto+Sans+SC:wght@400;700\u0026family=Noto+Sans+TC:wght@400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.991Z","timestamp":1783438639991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:02 GMT","end":"Mon, 07 Sep 2026 08:41:01 GMT"},"fingerprint":{"sha1":"FD:DA:E1:3E:1F:AC:E0:96:14:ED:37:58:30:0F:ED:9D:B4:5E:F1:EF","sha256":"7D:36:0C:A4:14:F6:05:8D:F4:E1:CD:BF:84:A7:03:AD:3F:C4:93:AE:B3:D6:7E:99:CB:92:D7:1F:29:A1:49:A4"}}},"request":{"raw":"GET /css2?family=Noto+Sans+JP:wght@400;700\u0026family=Noto+Sans+KR:wght@400;700\u0026family=Noto+Sans+SC:wght@400;700\u0026family=Noto+Sans+TC:wght@400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 07 Jul 2026 15:37:20 GMT\r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":881958,"size_decoded":235987,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1981)","md5":"c1b6b56aa1a3f24b536e0615627be83a","sha1":"5e98b62c41b5858f632e27f0ba28ce8002cb8edc","sha256":"720d995d4c1cfd320c966d77897e1caa09305e302b109af8820e6b81c5c63573","sha512":"cc58d25de8bbe4b313700de3c981be2681841df4b5a879359c74b155fe080749c897cd086a8f41197797550ac8b3293bc2c74dceab21e19bce2b80b0ac00d59d","ssdeep":"6144:wTXnRSjM6xC/3INJnkpOPGXB0uA4sfwS0nJ5+n9:0XAMWoa","tlshash":"6b152ea5450789dffee75ca252ced515be6924bcf980897c92f509c3ac0a01ed0cbb8d","first_seen":"2026-01-07T17:14:27.412884Z","last_seen":"2026-07-13T19:12:34.31501Z","times_seen":117,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":96,"receive":74,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/javascripts/jquery.periodicalupdater.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.995Z","timestamp":1783438639995,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /javascripts/jquery.periodicalupdater.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 6658\r\nlast-modified: Wed, 01 Jul 2026 03:20:56 GMT\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6658,"size_decoded":6874,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"081c6407861490f5d4696b225ac96d23","sha1":"94174a4123b8d486d014c042219fda1c21d9bd86","sha256":"850ebab175e20015432217d462b446fd904cc7e90ae8c0339212053481163969","sha512":"91da5f44d8757434b76a9ad85b63f4ebe4797fe5f722379d8b7c75f1779e5477e3927280cf329c4b71004b78e7acffbf06c7adae2da285c0d0126c18f8d5bf7c","ssdeep":"96:4GwsdNL6Gaoj7oRenP6wN6mUbnCrc0mGMrBxS5Mli6NyzuPbCVqlmqx:dwszdo2PObzCvmGMruKs6AyPbCVqlmqx","tlshash":"a3d1404e669f054909d37068dbbf63c13b32a02b2151e5607d2e0bd08fe99a4b1f6bd9","first_seen":"2023-03-07T18:48:05Z","last_seen":"2026-07-13T19:12:34.310942Z","times_seen":811,"resource_available":true,"data":null}},"time_used":854,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":854,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.pmeimg8.com/public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_2-adc364ec.jpg","fqdn":"images.pmeimg8.com","domain":"pmeimg8.com","tld":"com"},"ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.016Z","timestamp":1783438640016,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pmeimg8.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 13 Nov 2025 00:00:00 GMT","end":"Sat, 12 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"9D:8E:47:65:AD:19:CD:B4:6D:97:F3:CE:E3:78:87:0E:A4:3D:16:AE","sha256":"75:46:70:41:88:00:B7:7F:50:B0:F0:46:2B:26:D8:42:8B:70:3C:11:A3:59:6B:C4:12:D0:D9:1F:F6:38:C6:94"}}},"request":{"raw":"GET /public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_2-adc364ec.jpg HTTP/1.1\r\nHost: images.pmeimg8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 141320\r\nserver: nginx\r\nlast-modified: Fri, 20 Dec 2024 17:15:28 GMT\r\netag: \"6a8a31299743c4579443a76f418c09aa\"\r\naccept-ranges: bytes\r\ncache-control: no-cache\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":141320,"size_decoded":141656,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 1153x552, components 3","md5":"6a8a31299743c4579443a76f418c09aa","sha1":"d757fcf3d59ec052bdf72e9ade307c87f4ff34ba","sha256":"18b34d0efed00b2a19a0407c3379df474e45ae8101b5e37d7d1744a461b25286","sha512":"bb6f60f22d49a09bcb6bd392ccf10d22935f7bcf30bfbb29dab05aef95c9ddab1f3d1ed37bdc7029c510a5fd60963e7c68aff8afce2e6ade1ba1cb43bc9987d4","ssdeep":"3072:eF4YaU5K3gHmzjWWRpt58sHaLGlZ6+OydJT:eF4YszF558WALCdJT","tlshash":"32d3d0238e59d345a95ec2b9bd471e6d3b4f2b0caa8232fe21511ddf3d952211d8e02f","first_seen":"2025-10-24T01:05:13.05282Z","last_seen":"2026-07-13T19:12:34.316248Z","times_seen":403,"resource_available":false,"data":null}},"time_used":3457,"timings":{"blocked":247,"dns":0,"connect":285,"send":0,"wait":613,"receive":853,"ssl":1456},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-07T15:37:18.061Z","timestamp":1783438638061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380 HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:19 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 9379\r\nx-frame-options: DENY\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\netag: W/\"0b3ead96fdafedc8dc72f9ceb4a05ed0\"\r\nx-request-id: 252c0398-6572-43ed-9577-ed93424291ae\r\nx-runtime: 0.005698\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap:3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Adobe Fonts","description":"Adobe Fonts is a web-based service providing access to a vast library of high-quality fonts for web and print design.","website":"https://fonts.adobe.com","common_platform_enumeration":"","icon":"Adobe Fonts.svg","categories":["Font scripts"]},{"name":"Typekit","description":"Typekit is an online service which offers a subscription library of fonts.","website":"https://typekit.com","common_platform_enumeration":"","icon":"Typekit.png","categories":["Font scripts"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":9379,"size_decoded":9926,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (580), with CRLF, LF line terminators","md5":"9e044e8eb502ab2da1492d65ad0859bd","sha1":"e06c531327f349e1d04777b9c48d3f1f47b15ab1","sha256":"0b3ead96fdafedc8dc72f9ceb4a05ed0c105d8da9bc57b6410c5c6f595e62376","sha512":"76aa3c6ba58914a35a79c9734a5caee4084a0f1eca8df3c9b37698219cb6db9dbb6d7049a59401a67e2e7a7bf01e264197fca8fda9ba890c1a006aebda69c186","ssdeep":"192:f2vdM3s65CHu9Ez65QAptcibE9uHIRCblMoGwgkCquGExjtsbAORpR2RRkQfJsB1:Z6Hu9Ez65QAppbE9uHIRCblMKbohsBMa","tlshash":"531275924ae116ae3423d094b328be06c070d417969aed483fff53c4dfe6b858db2395","first_seen":"2025-10-24T01:05:13.048459Z","last_seen":"2026-07-13T19:12:34.319309Z","times_seen":403,"resource_available":true,"data":null}},"time_used":1452,"timings":{"blocked":-1,"dns":12,"connect":292,"send":0,"wait":568,"receive":0,"ssl":580},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/javascripts/jquery-latest.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.994Z","timestamp":1783438639994,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /javascripts/jquery-latest.min.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 88145\r\nlast-modified: Wed, 01 Jul 2026 03:20:56 GMT\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":88145,"size_decoded":88362,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-07-14T09:56:27.955723Z","times_seen":136529,"resource_available":true,"data":null}},"time_used":855,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":568,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/0f7/f7c/90-/original/bootstrap-3.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.999Z","timestamp":1783438639999,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/0f7/f7c/90-/original/bootstrap-3.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: 3wo6sP+UTPg+AKdAF85k8Rp6ZrC8MwQOGeY1IEkYW25mujj7HwXCNxbI5NAiy2nKIyMd3XadOzA=\r\nx-amz-request-id: W85E65XQ8TQQPMV4\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 04 Jun 2019 15:20:05 GMT\r\netag: \"894d79839facf38d9fd672bdbe57443d\"\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 75484\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":75484,"size_decoded":75871,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"894d79839facf38d9fd672bdbe57443d","sha1":"11277f4e04cf070a350e566b053ef2215993720c","sha256":"dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2","sha512":"34fffaf69de2045e8b90adaf72c6c3d73b99bb581832ee7de1be78d34753a3ba97d3aa1b8527ec1747d25e27594e4e0a4a9104e1e7ede811ab748aa1b766842c","ssdeep":"768:K/Lx8D6XlsB92TiwZi7vu6EBI7v8vaSx4ElvhLxs7St8PsBdZsWSdA:wVGihuv8ySx4EosbyWQA","tlshash":"af7340167af921614b5b30ba8cdf614c7238901b550bd42878ad93d46f50b38a2bbffd","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-07-14T06:57:29.37237Z","times_seen":2778,"resource_available":true,"data":null}},"time_used":1589,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1110,"receive":479,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"login.phishme.com.au/spa-ckeditor","fqdn":"login.phishme.com.au","domain":"phishme.com.au","tld":"com.au"},"ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.017Z","timestamp":1783438640017,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /spa-ckeditor HTTP/1.1\r\nHost: login.phishme.com.au\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 270\r\nserver: nginx\r\nlast-modified: Wed, 01 Jul 2026 12:24:14 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-14T10:18:37.519821Z","times_seen":17234759,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.pmeimg8.com/public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_3-c9537216.jpg","fqdn":"images.pmeimg8.com","domain":"pmeimg8.com","tld":"com"},"ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.018Z","timestamp":1783438640018,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pmeimg8.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 13 Nov 2025 00:00:00 GMT","end":"Sat, 12 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"9D:8E:47:65:AD:19:CD:B4:6D:97:F3:CE:E3:78:87:0E:A4:3D:16:AE","sha256":"75:46:70:41:88:00:B7:7F:50:B0:F0:46:2B:26:D8:42:8B:70:3C:11:A3:59:6B:C4:12:D0:D9:1F:F6:38:C6:94"}}},"request":{"raw":"GET /public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_3-c9537216.jpg HTTP/1.1\r\nHost: images.pmeimg8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 69669\r\nserver: nginx\r\nlast-modified: Fri, 20 Dec 2024 17:15:28 GMT\r\netag: \"e1fa5f32cc5c488248bb527b68bed9b6\"\r\naccept-ranges: bytes\r\ncache-control: no-cache\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69669,"size_decoded":70004,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 1156x232, components 3","md5":"e1fa5f32cc5c488248bb527b68bed9b6","sha1":"b0d58b1de1a7da774a626a4c842679ebadb43aa9","sha256":"bd47a0993621acf20524fe9e22f42b81a92a1e923aa53517e10fb239329395c3","sha512":"0221c5c12bc886957df75f4f9fa9b3259d4d57eb9e628fa09abc14b0e6480df70cd85552f018f41561f8217b41430a2e0484a9d7f65013461ed71f54b914b4dc","ssdeep":"1536:7EIoEbLWyyyyyyyyyyyyyyyMRf2Umn9kOVAtp2hYPRXrOliQh/z2JKFlPXrnkZ:7bKyyyyyyyyyyyyyyyMRf2Umn9kOVAtd","tlshash":"c263bfb7a04449061c3f41197f9a2f6c0564da4e74a8367f2e232f9ff79c369584ca2d","first_seen":"2025-10-24T01:05:13.032075Z","last_seen":"2026-07-13T19:12:34.313109Z","times_seen":404,"resource_available":false,"data":null}},"time_used":3457,"timings":{"blocked":247,"dns":0,"connect":285,"send":0,"wait":1134,"receive":333,"ssl":1456},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:21.668Z","timestamp":1783438641668,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://healthyemployee.work\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Jul 2026 01:48:31 GMT\r\nexpires: Fri, 02 Jul 2027 01:48:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 481730\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-14T10:18:00.930894Z","times_seen":234191,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":3,"connect":31,"send":0,"wait":17,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:21.669Z","timestamp":1783438641669,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://healthyemployee.work\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 03 Jul 2026 18:21:45 GMT\r\nexpires: Sat, 03 Jul 2027 18:21:45 GMT\r\ncache-control: public, max-age=31536000\r\nage: 335736\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-14T10:21:44.570557Z","times_seen":10745,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":33,"dns":1,"connect":0,"send":0,"wait":18,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/favicon.ico","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:22.098Z","timestamp":1783438642098,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Tue, 07 Jul 2026 15:37:22 GMT\r\ncontent-length: 0\r\ncache-control: no-cache\r\nx-request-id: ab6d8d0a-2fdb-4a44-a312-d63b8805ce0b\r\nx-runtime: 0.000124\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":234,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-14T10:18:37.519821Z","times_seen":17234759,"resource_available":true,"data":null}},"time_used":286,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.001Z","timestamp":1783438640001,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/1e1/ef7/31-/original/static-education-l10n-vanilla.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: /cGz3+E4aqZ20qOvevt9d7JuSQwoSSVGGrasl/KO7rDGBKXxUzA4c9tY0XiIj+XkeBj4xvKuBig=\r\nx-amz-request-id: W85B3KRMFD84EKDY\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 22 Dec 2020 17:20:06 GMT\r\netag: \"82d8a0db67e0e0ef08aea9e294267221\"\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 15993\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":15993,"size_decoded":16380,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"17e7e8087b920180489cd3cfb581c63a","sha1":"69068d481119a5dc5c2bf2ea9cf473dd45a2ed42","sha256":"fec62a55e88967be13b79af125095b25ddd2888e1582ef7efe4e6da27ce4b47b","sha512":"08800bd4cef39a1f4266895563a1bb80f627d67499a2f67150c47eab05ca558e6138ec111743d72add7f329ac32858bf5de80d15bbb16ea071847314aed9f6f2","ssdeep":"384:YnX9B5i6iami/TiE/PEhiXS7iL3MfAk7kk2k9iriiqKmmxkwkFEnqlW0sSKFptm:YntBAjY/2E9CetOiqKmmxXiTSptm","tlshash":"cd726119158512ba36726369b6d92dc5fe61006b02117c41bbafc6646ff3da082f2ff4","first_seen":"2025-10-24T01:05:13.03503Z","last_seen":"2026-07-13T19:12:34.312036Z","times_seen":409,"resource_available":true,"data":null}},"time_used":1141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1138,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/de8/1c5/91-/original/static-education-language-selector.css","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.770Z","timestamp":1783438639770,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/de8/1c5/91-/original/static-education-language-selector.css HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: /X7MDNdGMCmGlgFk74s4CckudvvLCEvLAtQeWjWmTGxaQoz6Ra7rQK2V7P20Ua88daxHUCZ64i0=\r\nx-amz-request-id: W85081416KD66914\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 03 May 2022 08:20:06 GMT\r\netag: \"8628a73123073a62c7dc80ff71f2ce40\"\r\naccept-ranges: bytes\r\ncontent-type: text/css\r\ncontent-length: 5051\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":5051,"size_decoded":5423,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"8628a73123073a62c7dc80ff71f2ce40","sha1":"d68ce7855acfb9b3509395466c04d9e76213b6f5","sha256":"1de964843747b049b44d265664f2b92f0cca652ec7943def08662115f77458b9","sha512":"30fc90f02097a17fb6badf35f06ec7d8feb3882e3776564bbfaa8fcefae181de022288ecec45d8030a642b08ba9631aa95865cc26427b984f08a9d31267f05a8","ssdeep":"96:/qVq5uMlWni6A9dO5cFnqVqIqVqZJqVqT72NqsF5cip2tynh4kp:/wq5uMwU9A8wqIwqHwqmwsF5cip2tynd","tlshash":"42a10d4ce6020449b13787393fe17e61d6d480839a45396abbe472607ff79788391eae","first_seen":"2023-04-12T19:29:59Z","last_seen":"2026-07-13T19:12:34.319852Z","times_seen":575,"resource_available":false,"data":null}},"time_used":1123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.987Z","timestamp":1783438639987,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:02 GMT","end":"Mon, 07 Sep 2026 08:41:01 GMT"},"fingerprint":{"sha1":"FD:DA:E1:3E:1F:AC:E0:96:14:ED:37:58:30:0F:ED:9D:B4:5E:F1:EF","sha256":"7D:36:0C:A4:14:F6:05:8D:F4:E1:CD:BF:84:A7:03:AD:3F:C4:93:AE:B3:D6:7E:99:CB:92:D7:1F:29:A1:49:A4"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 07 Jul 2026 15:37:20 GMT\r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7581,"size_decoded":1405,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"571626c78b47459d0909a9fb462285c4","sha1":"1688cea144602393dcb3b3f90b57e9f960d9ca41","sha256":"3819b533b97affbcbc2cae6f4e5b67bcc572c9c394e4f09d8a2dede07766565c","sha512":"2930aac06c897f9659f936df747660b0d99001009181b2b0f8c1d5d8ee76955971525554f39470fdcd2f06413128d6d3d4cb4b264b187d2b7e5435850cd5ec1e","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDONEhYO3RrxGx:8KYXY+4","tlshash":"53f18992002ba400ab971dc233cf7f3aaece10896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-19T14:18:38.976349Z","last_seen":"2026-07-14T09:28:25.193389Z","times_seen":593,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":33,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/5b8/ee7/1e-/original/jquery-latest.min.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:19.998Z","timestamp":1783438639998,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/5b8/ee7/1e-/original/jquery-latest.min.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: aKGsfomaDFDwJ36fO30j/uzK3paqYV/wO4KkpEQ+iDw9VpiLdPjeoCLuTQgIzrP9Fb8xx1V0E4Y=\r\nx-amz-request-id: W8507B6TF4TC55JM\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Tue, 07 May 2024 14:00:08 GMT\r\netag: \"2c872dbe60f4ba70fb85356113d8b35e\"\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 87533\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":87533,"size_decoded":87958,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-07-14T10:19:25.107522Z","times_seen":178805,"resource_available":true,"data":null}},"time_used":1592,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1125,"receive":467,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.pmeimg8.com/public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_1-0a1d27fd.jpg","fqdn":"images.pmeimg8.com","domain":"pmeimg8.com","tld":"com"},"ip":{"addr":"54.66.154.89","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.015Z","timestamp":1783438640015,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pmeimg8.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 13 Nov 2025 00:00:00 GMT","end":"Sat, 12 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"9D:8E:47:65:AD:19:CD:B4:6D:97:F3:CE:E3:78:87:0E:A4:3D:16:AE","sha256":"75:46:70:41:88:00:B7:7F:50:B0:F0:46:2B:26:D8:42:8B:70:3C:11:A3:59:6B:C4:12:D0:D9:1F:F6:38:C6:94"}}},"request":{"raw":"GET /public/user_assets/dd0fd2e6-90f8-4e72-aecb-a47f8e25147d/mar_2024_m_1-0a1d27fd.jpg HTTP/1.1\r\nHost: images.pmeimg8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 223919\r\nserver: nginx\r\nlast-modified: Fri, 20 Dec 2024 17:15:29 GMT\r\netag: \"fc66b71ed6808294df76478328e6c44a\"\r\naccept-ranges: bytes\r\ncache-control: no-cache\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223919,"size_decoded":224255,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 1277x566, components 3","md5":"fc66b71ed6808294df76478328e6c44a","sha1":"c61ea4d4fc42d6996aa5a3ea7ef2842cc120dc6c","sha256":"112b4171ac15c4f1dd8ff3beec550b3488ecc929eec3db787aef1a74e317dfa6","sha512":"19d6741a0469c6118a2e47441e61b6fcbabe96706ec63445023fe51bc3407011038adcdac21c1ca283bd0812475fd999411d324328669f4efe023ec2612502aa","ssdeep":"6144:6j165wGzm0YJpm9pRpf4FeU5CFMKKKVFgJ4T7Un:A16t8GPRpfUx54N64Tm","tlshash":"0924d1238c58d696b88e83e4bd0e5c7d29df0f4d5586e9ba806c1ec97ee10025d4f92f","first_seen":"2025-10-24T01:05:13.029673Z","last_seen":"2026-07-13T19:12:34.321462Z","times_seen":403,"resource_available":false,"data":null}},"time_used":3693,"timings":{"blocked":247,"dns":0,"connect":285,"send":0,"wait":1134,"receive":569,"ssl":1458},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"images.pmeimg8.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/log_info?tid=8c5781c2-7b1e-4035-b1d7-990e269e5380\u0026_=1783438641621","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:42.078Z","timestamp":1783438662078,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /log_info?tid=8c5781c2-7b1e-4035-b1d7-990e269e5380\u0026_=1783438641621 HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:42 GMT\r\ncontent-type: text/plain\r\ncontent-length: 0\r\nx-frame-options: DENY\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\nx-request-id: 4b7853f3-ae8f-4a90-b5f2-5424e5e89ee4\r\nx-runtime: 0.112106\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":486,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-14T10:18:37.519821Z","times_seen":17234759,"resource_available":true,"data":null}},"time_used":399,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":399,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/2ea/4c2/d1-/original/quiz-logic.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.005Z","timestamp":1783438640005,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/2ea/4c2/d1-/original/quiz-logic.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: uZ5krO7DWWVCMZo2d8FgtYTsbNcOochXxFWR4JR0O7XkYE0GwHVuhWN4ueK+pDkXHvcXuOQmN8A=\r\nx-amz-request-id: W8572EZDFKP87MHM\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Mon, 21 Dec 2020 17:00:06 GMT\r\netag: \"1cdc981c3ad9af37f9eefbee51c6da2e\"\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 9303\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":9303,"size_decoded":9689,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"1cdc981c3ad9af37f9eefbee51c6da2e","sha1":"998b1735bb3a82a6c2d84d0091ddc10144bd04c8","sha256":"edf43156fe6795519974e0635a21b4f1b34c70b7d5e844ab86b46eb3bf6d2ece","sha512":"1660e03db8b153c6879faa4e20e5491c29e4cd711d32f9ebdc505885312c070dcc794215a5272515f4f2903f43d4ddcbe447c9eed43d45707cf936d72144a5f5","ssdeep":"192:oQiOsBaLtEbizE0dui77Zh8E86PZpikiGiCil:oQiOsm2mzhci77ZhR7PZpikiGiCil","tlshash":"7e12521515290336a43367baeb5b61aeeab0491b7205f3257c3cd2941fb0c1266f3ee7","first_seen":"2023-11-16T22:55:40Z","last_seen":"2026-07-13T19:12:34.312556Z","times_seen":422,"resource_available":true,"data":null}},"time_used":1583,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1583,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"p.typekit.net/p.css?s=1\u0026k=wgp5bvf\u0026ht=tk\u0026f=42213.42215.42219\u0026a=36181509\u0026app=typekit\u0026e=css","fqdn":"p.typekit.net","domain":"typekit.net","tld":"net"},"ip":{"addr":"23.33.119.26","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.227Z","timestamp":1783438640227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"use.typekit.net","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Fri, 29 May 2026 00:00:00 GMT","end":"Sun, 13 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"6D:59:E1:10:7C:04:87:2C:2B:42:9B:0B:02:BE:4A:FF:E8:09:E3:E9","sha256":"51:4C:B4:20:1D:97:45:B3:FE:50:80:99:68:E9:6C:33:8C:E3:66:B0:8E:BA:01:2F:87:14:D1:BE:86:8D:0E:73"}}},"request":{"raw":"GET /p.css?s=1\u0026k=wgp5bvf\u0026ht=tk\u0026f=42213.42215.42219\u0026a=36181509\u0026app=typekit\u0026e=css HTTP/1.1\r\nHost: p.typekit.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://use.typekit.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: text/css\r\ncontent-length: 5\r\nlast-modified: Sun, 24 Nov 2024 12:45:53 GMT\r\netag: \"67432001-5\"\r\ncache-control: public, max-age=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\naccept-ranges: bytes\r\ndate: Tue, 07 Jul 2026 15:37:20 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5,"size_decoded":338,"mime_type":"text/css","magic":"ASCII text","md5":"83d24d4b43cc7eef2b61e66c95f3d158","sha1":"f0cafc285ee23bb6c28c5166f305493c4331c84d","sha256":"1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb","sha512":"e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6","ssdeep":"","tlshash":"e630000000000000000000000000000000000c00000000000000000000000000000000","first_seen":"2023-03-12T07:28:04Z","last_seen":"2026-07-14T10:09:03.828246Z","times_seen":169194,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":4,"connect":3,"send":0,"wait":3,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/log_info?tid=8c5781c2-7b1e-4035-b1d7-990e269e5380\u0026_=1783438641620","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:31.778Z","timestamp":1783438651778,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /log_info?tid=8c5781c2-7b1e-4035-b1d7-990e269e5380\u0026_=1783438641620 HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 07 Jul 2026 15:37:31 GMT\r\ncontent-type: text/plain\r\ncontent-length: 0\r\nx-frame-options: DENY\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: no-store\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\nx-request-id: d24a2b5d-72eb-406a-833c-04a26ccd9feb\r\nx-runtime: 0.003077\r\nstrict-transport-security: max-age=15768000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":486,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-14T10:18:37.519821Z","times_seen":17234759,"resource_available":true,"data":null}},"time_used":289,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"healthyemployee.work/system/content_files/uploads/5cd/382/77-/original/interactive-education.js","fqdn":"healthyemployee.work","domain":"healthyemployee.work","tld":"work"},"ip":{"addr":"13.210.89.195","port":443,"asn":16509,"as":"AMAZON-02","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380","date":"2026-07-07T15:37:20.002Z","timestamp":1783438640002,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"healthyemployee.work","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 May 2026 14:13:47 GMT","end":"Fri, 14 Aug 2026 14:13:46 GMT"},"fingerprint":{"sha1":"E9:F8:19:D6:E0:DD:46:0E:B4:7D:F2:C4:01:BA:54:C5:3C:D9:56:55","sha256":"D9:E2:2C:95:42:50:83:58:D3:0F:AE:F3:C2:90:F1:28:B4:A6:D8:E9:5E:B4:DE:46:EF:AC:25:85:D1:C8:F3:BD"}}},"request":{"raw":"GET /system/content_files/uploads/5cd/382/77-/original/interactive-education.js HTTP/1.1\r\nHost: healthyemployee.work\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://healthyemployee.work/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-amz-id-2: bPKCBt30w3+mQaCGI1Ysn3TrkYSAfWaOjRNoWVkMcWc3i1Opt0M05CMEDUhsvu8+E8BHJ9AAXmU=\r\nx-amz-request-id: W85DVP834DF8TSJ3\r\ndate: Tue, 07 Jul 2026 15:37:21 GMT\r\nlast-modified: Fri, 22 May 2020 11:30:06 GMT\r\netag: \"f02a54af3d82f7e8d6c9d3483a6bcdd8\"\r\naccept-ranges: bytes\r\ncontent-type: application/javascript\r\ncontent-length: 894\r\nserver: AmazonS3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":894,"size_decoded":1279,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"f02a54af3d82f7e8d6c9d3483a6bcdd8","sha1":"13857b461a890ba53dfc3636ab1053cb869d1059","sha256":"d74ddf67dbd1e98dd9c737bed791e1f901f14054db745398a26b74071532a1d8","sha512":"bbc1b44cf6e27fa9474bf2c1d93247a7acbd9d5356a4e750bdcd53ae472abbcf7abb04db503ce15b4c857079e738ed2db622db214e0289cfb3c492891558047d","ssdeep":"","tlshash":"9a1125aff51a22a2617f3fe20336b11de576540f418046a1783d88f27f264456226f7c","first_seen":"2023-11-16T22:55:39Z","last_seen":"2026-07-13T19:12:34.318098Z","times_seen":420,"resource_available":true,"data":null}},"time_used":1587,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1587,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"healthyemployee.work","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}