{"report_id":"daaec26c-ee0c-4409-8a5c-446219b03cd7","version":0,"status":"done","tags":[],"date":"2026-09-22T21:09:07Z","url":{"schema":"http","addr":"exedu.site/","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"exedu.site/","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"title":"Exodus — Non-custodial Crypto Wallet","dom":{"size":29793,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (29097)","md5":"d412103dd965e985112fa9d85384e2fc","sha1":"6d7e9e05c8197e8e4e6ae7eeb8234c8dcf72db0e","sha256":"61d2b942fab0c91caf12b5af7f0f43628374ae4e1e4a620776859d3e2ac8fdf3","sha512":"b74584e639949a281ce07702152ac36769f1c03ec3e2ced4d62d24f52040deb95dda5054cf8521b84baf2815d3b379de7c3ebb5bd0e46dc8559de25a8a0fa246","ssdeep":"384:wSQOx05nrGPKJgg8T4xksc64Jysq7vInzVbUKEV1Km77Ysl:Px0rGV4xksc64Jysq7v+B6V1Kq7Ysl","tlshash":"76d2b8a4700c123e6d2b9b94fad5932cc119f541ef238829b24d048bfac7ff575a6b94","dom_hash":"domhash7698f66dd4b84dfccffa7f386c84b343","first_seen":"2026-09-22T20:54:42.387134Z","last_seen":"2026-09-22T21:09:20.39292Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"exedu.site/","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T21:09:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"exedu.site","ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":30,"request_count":10,"received_data":2687902,"sent_data":7828,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Lovable","description":"Lovable is an AI-powered, no-code platform that lets users build functional web apps from natural language prompts instead of writing code.","website":"https://lovable.dev/","common_platform_enumeration":"","icon":"Lovable.png","categories":["CMS"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-20T22:43:37.149177Z","alert_count":0,"request_count":6,"received_data":302870,"sent_data":3420,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-20T22:43:34.841753Z","alert_count":0,"request_count":1,"received_data":15846,"sent_data":534,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"exedu.site/~flock.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed557a78d5301fbb961abfe911a42b62","sha1":"d11a2a4e9fee28c4b1abc38cd8136bffec7e325b","sha256":"a86e084b4f82709814be6c15fd6305daa783fda87ad95402da9a4d3a1dd6d748","sha512":"18dd1525e2b4d89e3c46d92367fca020cf99fb07856acfd96a25dc7410611eea83b438c91691683983495945eb04a9427bc63e2a383cbe93449f4df0eb1ddb51","ssdeep":"384:FtUCBXTpeaFEo5TTThri1t/mCsOCXiTNZruJ4vKFlcEhRCDxOcX/YM2Vybyq/kmt:n7XTpeauI/Thri1CKWM4ldRzurwkTO0D","tlshash":"cea2b6d61007243d57ead1a13929f7d63177ea98a0caec8a7de91f84d414c83f3f294a","size":21296,"data":"","first_seen":"2025-07-30T15:25:28.733337Z","last_seen":"2026-09-23T02:47:21.551307Z","times_seen":17291,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/password-ZT5FR8Ya.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ea024ed8b58578757bf3ff0fc467a4c","sha1":"dc10393a814d8bcef08720afc15b21aa04cffe79","sha256":"eef4ab6fa83deafec5b28964fc9d26b022cb3f66140d2a39af4bba69bbd6dbf2","sha512":"8dd1e50734c461ac9106458b6fcda83f2f48401e9d08991bbef9e5b7e58e7350d5da6649864f64335e86e15f9757cbf1413e255ae4900c52e5ab0952d5bbc598","ssdeep":"1536:5t54Gkl0hJXS1QPK3ZFiqNv12Yebx/c64Jysq7vdEie3Zhuo:Z5FGQirNvgYegJko","tlshash":"ce633b50f409013d59bf5292e49ca758e4383602f9268915f25e0c3eebc6bea35b7f1e","size":68770,"data":"","first_seen":"2026-09-22T20:54:42.397808Z","last_seen":"2026-09-22T21:09:20.399593Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/index-Cte-7zdn.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7619a3c54a7c0068a9355a2ecf0edfd0","sha1":"e3611c51d1685243653a53cb5bd6c1f45838ba78","sha256":"99b50f539862d622cb211dc98a2b7ac9948693d7b5513ab13638fc89c98b7659","sha512":"c0b406f8d3bc58c5b35059e270568522135825ee9d9bd3aa570299e68e8537fef85008380fac5f115665745b5ce727860544453f37eec00a38cce4ae65a00ed4","ssdeep":"12288:nYdyB0hXDYLz8pTZWvzg54NjTExkSZ7Rg/:YdyB0FDYLApTZWvfe7Rg/","tlshash":"efc46fd872e6b5220bd254e1807b0503f2396826740c8464f66ceeef3ab5849d57bfbd","size":592269,"data":"","first_seen":"2026-09-22T20:54:42.395725Z","last_seen":"2026-09-22T21:09:20.397087Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/index-EJ7WY0sQ.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f66b9a0548c088460fe00385a6a40b2","sha1":"cfe2bbbec3c31d054e48aae1eb62b2cb0094c08c","sha256":"e4ad920ec7d67ae8bd0aef3d63556f780a022c82f123cc42372b0a45297a55aa","sha512":"0dbe45e9375863d1f2cf81c139177a77a8034c4a9995cd5903735461d870b1b5e8a1e99251f28fca634598c450c580be88a4602365eaeea6d4ef4e3865bfd735","ssdeep":"24576:trK+OQ+imKa2xdfR0y2U5KHxar+V19kQ38SFK+1ornffM:tv2imMxdfR0y2U5SLVwKFK+1orffM","tlshash":"ae356b4032a5a97683fe18e004bb18c5a13c8d54f44c58bef1aca4e73d65ac6a5e7f7c","size":1128622,"data":"","first_seen":"2026-09-22T20:54:42.403394Z","last_seen":"2026-09-22T21:09:20.401699Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"exedu.site/assets/styles-Dsq-VGwx.css","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.037Z","timestamp":1790111316037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /assets/styles-Dsq-VGwx.css HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/css; charset=utf-8\r\nx-deployment-id: psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716116.As5EX3AD5hpiovC2YoSzOyQIsgEQUsBDJ0YOzTaegFs\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f4492d384049c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":137810,"size_decoded":21658,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"58eb58f43c1231f38f830444a4aa58f6","sha1":"aa6d735dc774e8ab0f7aab44fd309ded776ec478","sha256":"f1e74dfaaa8a465e3f11dfa2ef11f608bc780a43b85583cec88c2da1e03b54d0","sha512":"74c43f4938dcb947bb0c009018c5f210a4190408ae905d605213f8fc1de9da148899e78b50fb2cd845f00384c0bbf2d505856e0db224cb25208d3e3e6ed135c2","ssdeep":"3072:GYuv32RHzkuG3NEhrm1lnnfGahX6HyY65BnUc21e7mer6lvnkfzWMq+WDhra8fyp:+2RHzkuG3NEhrm1lnnfGahX6HyY6p7fv","tlshash":"fed394a0b175e53fbc23b0fd938ce44ca50ab0d4dc6947ecba15a11627d3bf66ca6904","first_seen":"2026-09-22T20:54:42.390573Z","last_seen":"2026-09-22T21:09:20.393786Z","times_seen":2,"resource_available":true,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.501Z","timestamp":1790111316501,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 243111\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"103a99831fc4a0c9d554204ec178922a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: a3f4493028a949c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":243111,"size_decoded":243678,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 216x216, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 825x819, components 3","md5":"103a99831fc4a0c9d554204ec178922a","sha1":"c3ad005c15c7fa467b9ce526cf09219d692ffc64","sha256":"5c3cfa49d73df066cf873c1b24980173b1c15c16a7671d78e0ad447b5a80b03d","sha512":"db4e208de01a0aeb374c52de9cb3f42e8c7fe220b92690619dcefffa074bd10d2aaa2d6c9a2b87093d5740aea71dd290a6607fde301b42d332c1c2c23614b906","ssdeep":"6144:sF6O0O92kYnOa1pBcln4TZivlij4vLYGCux8/:sF6O0O92dOa1pOokvlij8YG7u","tlshash":"463412beed87d361467f2aba905bbdcd13815fed00fc8e4945104d0a97ca7a08c8a4ed","first_seen":"2026-09-22T20:54:42.389324Z","last_seen":"2026-09-22T21:09:20.394999Z","times_seen":2,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":89,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/~api/analytics","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.816Z","timestamp":1790111316816,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"POST /~api/analytics HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nContent-Type: application/json\r\nContent-Length: 331\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U; session-id=19340a2b-79f9-4f20-8e8e-6dca3c76df9f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":331,"data":"{\"timestamp\":\"2026-09-22T21:08:36.698Z\",\"action\":\"page_hit\",\"version\":\"1\",\"session_id\":\"19340a2b-79f9-4f20-8e8e-6dca3c76df9f\",\"payload\":\"{\\\"user-agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\\\",\\\"locale\\\":\\\"en-US\\\",\\\"referrer\\\":\\\"\\\",\\\"pathname\\\":\\\"/\\\",\\\"href\\\":\\\"https://exedu.site/\\\"}\"}"}},"response":{"raw":"HTTP/2 202 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-length: 8\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: a3f449321e0049c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8,"size_decoded":337,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"382ab522931673c11e398ead1b7b1678","sha1":"61a0572c4893ef34311320d84c82df88bea83e11","sha256":"a00fb0c50741f81bb51d35b4475a4357f8039aabd896a21036bc516839401595","sha512":"685c859b43ec0b2f873fb61ff4c48b3748ede3e31bdda719b69b528546f7a1d528216146db9626d1a411dccdd13f3fd155f3d62d3e2ec8090c71f6710ee60641","ssdeep":"","tlshash":"455000003c0000c0000000c000000000c0000000000000c0c000000000c0c000000000","first_seen":"2023-04-11T14:35:59Z","last_seen":"2026-09-23T02:47:21.553481Z","times_seen":7060,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.061Z","timestamp":1790111317061,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 84924\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 16:02:24 GMT\r\nexpires: Tue, 21 Sep 2027 16:02:24 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:55 GMT\r\ncontent-type: font/woff2\r\nage: 104773\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84924,"size_decoded":85737,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 84924, version 1.0","md5":"f5b588b5cfef2173838149769c8a0269","sha1":"5312086a01f8e8299094ddee5819b9727a19cae2","sha256":"b8811a6cd6f7e0707dfc9e9e6f1daf5f6f450b51e887e163945a9ade91c2720f","sha512":"05d5271c633bbe102775c0b6df9c5e110dae3a2517061714bb5c26ec66a00f8e1b62961135ec96962e7ccaf3942d8e32bd86f42558cbac8ee16ff6c333117886","ssdeep":"1536:PABWz4rSN/GzH27xN5UR1OnX+uyRsd1osLZBi/JGyQI01xDj+C:PAG4rCGa7L5UR1OnX+fGd/VB03QI+xP","tlshash":"378302b4ae71b3968f1c7fe46396273c2a7bdf41053950aeae44e16787f00dba148784","first_seen":"2025-05-29T19:39:57.235915Z","last_seen":"2026-09-23T05:14:40.245612Z","times_seen":21574,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":26,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/index-Cte-7zdn.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.038Z","timestamp":1790111316038,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /assets/index-Cte-7zdn.js HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nx-deployment-id: psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716116.As5EX3AD5hpiovC2YoSzOyQIsgEQUsBDJ0YOzTaegFs\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f4492d384749c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":592269,"size_decoded":175460,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42077)","md5":"7619a3c54a7c0068a9355a2ecf0edfd0","sha1":"e3611c51d1685243653a53cb5bd6c1f45838ba78","sha256":"99b50f539862d622cb211dc98a2b7ac9948693d7b5513ab13638fc89c98b7659","sha512":"c0b406f8d3bc58c5b35059e270568522135825ee9d9bd3aa570299e68e8537fef85008380fac5f115665745b5ce727860544453f37eec00a38cce4ae65a00ed4","ssdeep":"12288:nYdyB0hXDYLz8pTZWvzg54NjTExkSZ7Rg/:YdyB0FDYLApTZWvfe7Rg/","tlshash":"efc46fd872e6b5220bd254e1807b0503f2396826740c8464f66ceeef3ab5849d57bfbd","first_seen":"2026-09-22T20:54:42.395725Z","last_seen":"2026-09-22T21:09:20.397087Z","times_seen":2,"resource_available":true,"data":null}},"time_used":341,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/index-EJ7WY0sQ.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.040Z","timestamp":1790111316040,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /assets/index-EJ7WY0sQ.js HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nx-deployment-id: psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716116.As5EX3AD5hpiovC2YoSzOyQIsgEQUsBDJ0YOzTaegFs\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f4492d485249c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1128622,"size_decoded":379765,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"26e3dc23efba2fe9424eb6d187faa7e9","sha1":"47f4f464c6bf2ffe1485b3b41d45accc710040dc","sha256":"81ca45cdc4deccf08de5a312fab6c149dfe537b343c763d81111324bc072421a","sha512":"9743a724e805e37b835acd1cb7bd01e6567ebbce30119d9618c0fd37c3b2ad400653e82d843a56f9f9f8daf740279b6cb1738caadd7ade36216b1471ba734c20","ssdeep":"24576:trK+OQ+imKa2xdfR0y2U5KHxar+V19kQ38SFK+1ornff:tv2imMxdfR0y2U5SLVwKFK+1orff","tlshash":"9d355a4032a5697683ee14e004b71cc5a13c8d54f48c58bef5aca8eb3da5ac5a4e7f7c","first_seen":"2026-09-22T20:54:42.396663Z","last_seen":"2026-09-22T21:09:20.397675Z","times_seen":2,"resource_available":true,"data":null}},"time_used":628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":628,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.500Z","timestamp":1790111316500,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 243111\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"103a99831fc4a0c9d554204ec178922a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: a3f4493028a849c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":243111,"size_decoded":243678,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 216x216, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 825x819, components 3","md5":"103a99831fc4a0c9d554204ec178922a","sha1":"c3ad005c15c7fa467b9ce526cf09219d692ffc64","sha256":"5c3cfa49d73df066cf873c1b24980173b1c15c16a7671d78e0ad447b5a80b03d","sha512":"db4e208de01a0aeb374c52de9cb3f42e8c7fe220b92690619dcefffa074bd10d2aaa2d6c9a2b87093d5740aea71dd290a6607fde301b42d332c1c2c23614b906","ssdeep":"6144:sF6O0O92kYnOa1pBcln4TZivlij4vLYGCux8/:sF6O0O92dOa1pOokvlij8YG7u","tlshash":"463412beed87d361467f2aba905bbdcd13815fed00fc8e4945104d0a97ca7a08c8a4ed","first_seen":"2026-09-22T20:54:42.389324Z","last_seen":"2026-09-22T21:09:20.394999Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.057Z","timestamp":1790111317057,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:55:16 GMT\r\nexpires: Tue, 21 Sep 2027 15:55:16 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 105201\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-23T04:46:53.524576Z","times_seen":295724,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":40,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:08:35.039Z","timestamp":1790111315039,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:35 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, must-revalidate, max-age=0\r\nx-deployment-id: psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nset-cookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; Path=/; Max-Age=86400; SameSite=Lax; Secure\n__cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U; HttpOnly; SameSite=None; Secure; Path=/; Domain=exedu.site; Expires=Tue, 22 Sep 2026 21:38:35 GMT\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f449275f7849c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__dpl","value":"psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ","quoted":false,"path":"/","max_age":86400,"secure":true,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"__dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; Path=/; Max-Age=86400; SameSite=Lax; Secure"},{"name":"__cf_bm","value":"Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U","quoted":false,"path":"/","domain":"exedu.site","expires":"2026-09-22T21:38:35Z","raw_expires":"Tue, 22 Sep 2026 21:38:35 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U; HttpOnly; SameSite=None; Secure; Path=/; Domain=exedu.site; Expires=Tue, 22 Sep 2026 21:38:35 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Lovable","description":"Lovable is an AI-powered, no-code platform that lets users build functional web apps from natural language prompts instead of writing code.","website":"https://lovable.dev/","common_platform_enumeration":"","icon":"Lovable.png","categories":["CMS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4410,"size_decoded":2947,"mime_type":"text/html; charset=utf-8","magic":"data","md5":"93537b9b5ebb5ee5c23206ae72bedc03","sha1":"5722d7176b9e23a94da04680158cf816a3cb6bd3","sha256":"c08ed49c3059ddad5ed2679f7c7b87a43c39b68e24b2e3e7dc702c35b1953bd6","sha512":"7be2ca55e5024b243a908ffc0b28e35d20ca15c8848c6dc1ab4a587364a0ca24a40a36bee2e686f3be675425f7f2017d3251c213a02bcdb3cf40eb1d8a3df341","ssdeep":"96:TBe0YmfduHBe+co9Io3DUR0l4sBCFSyzW0Gx4Iwk1t:NYmfduhv4h1a4/kn","tlshash":"ce91a6a34e14542a52b886f6e422f14492776146f288e9ecf9bdd8de18c1fe7407be31","first_seen":"2026-09-22T21:09:20.398644Z","last_seen":"2026-09-22T21:09:20.398644Z","times_seen":1,"resource_available":true,"data":null}},"time_used":637,"timings":{"blocked":-1,"dns":34,"connect":2,"send":0,"wait":581,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/assets/password-ZT5FR8Ya.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.041Z","timestamp":1790111316041,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /assets/password-ZT5FR8Ya.js HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nx-deployment-id: psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716116.As5EX3AD5hpiovC2YoSzOyQIsgEQUsBDJ0YOzTaegFs\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f4492d485549c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":68770,"size_decoded":21384,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9ea024ed8b58578757bf3ff0fc467a4c","sha1":"dc10393a814d8bcef08720afc15b21aa04cffe79","sha256":"eef4ab6fa83deafec5b28964fc9d26b022cb3f66140d2a39af4bba69bbd6dbf2","sha512":"8dd1e50734c461ac9106458b6fcda83f2f48401e9d08991bbef9e5b7e58e7350d5da6649864f64335e86e15f9757cbf1413e255ae4900c52e5ab0952d5bbc598","ssdeep":"1536:5t54Gkl0hJXS1QPK3ZFiqNv12Yebx/c64Jysq7vdEie3Zhuo:Z5FGQirNvgYegJko","tlshash":"ce633b50f409013d59bf5292e49ca758e4383602f9268915f25e0c3eebc6bea35b7f1e","first_seen":"2026-09-22T20:54:42.397808Z","last_seen":"2026-09-22T21:09:20.399593Z","times_seen":2,"resource_available":true,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/~flock.js","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.042Z","timestamp":1790111316042,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /~flock.js HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncache-control: max-age=1500\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a3f4492d486049c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21296,"size_decoded":8697,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21296), with no line terminators","md5":"ed557a78d5301fbb961abfe911a42b62","sha1":"d11a2a4e9fee28c4b1abc38cd8136bffec7e325b","sha256":"a86e084b4f82709814be6c15fd6305daa783fda87ad95402da9a4d3a1dd6d748","sha512":"18dd1525e2b4d89e3c46d92367fca020cf99fb07856acfd96a25dc7410611eea83b438c91691683983495945eb04a9427bc63e2a383cbe93449f4df0eb1ddb51","ssdeep":"384:FtUCBXTpeaFEo5TTThri1t/mCsOCXiTNZruJ4vKFlcEhRCDxOcX/YM2Vybyq/kmt:n7XTpeauI/Thri1CKWM4ldRzurwkTO0D","tlshash":"cea2b6d61007243d57ead1a13929f7d63177ea98a0caec8a7de91f84d414c83f3f294a","first_seen":"2025-07-30T15:25:28.733337Z","last_seen":"2026-09-23T02:47:21.551307Z","times_seen":17291,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exedu.site/__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg","fqdn":"exedu.site","domain":"exedu.site","tld":"site"},"ip":{"addr":"185.158.133.1","port":443,"asn":13213,"as":"UK-2 Limited","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.026Z","timestamp":1790111317026,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exedu.site","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 14:17:14 GMT","end":"Wed, 11 Nov 2026 15:17:09 GMT"},"fingerprint":{"sha1":"50:CC:A8:85:CD:03:16:95:FB:F8:82:0A:F4:9E:F2:0B:3A:2D:48:08","sha256":"D5:5A:DF:4A:E5:6D:A9:C3:4F:9F:02:60:80:5F:00:DC:1D:C1:27:C8:98:C5:A8:ED:65:A3:2D:58:94:0F:00:55"}}},"request":{"raw":"GET /__l5e/assets-v1/e9833ee9-188a-4f4c-ac34-743a5b99ced9/exodus-logo.jpeg HTTP/1.1\r\nHost: exedu.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __dpl=psr2.f6b8f3e4-72a9-4c1c-ad64-60864d7246d0.1790716115.Zyfz9r4bmJVjkFs1zNsppv67ZcbR4LkLTVYrOp52FWQ; __cf_bm=Pn4MvrUqML7dIXCu4haDdkjdG_Rqfk7RrAvR4LFE06U-1790111315.1013172-1.0.1.1-PInhmAna8rKTYYJ25fchTBX8Rwfh3wUzNbAHl1zbOnFWyiliRNrZMSxF3jE72bAnxqZTHr1KITO_SCCq0kt_Umnvq_o3_ZURRRXsj6jOkI2NhoVC2IdPdbMt86_K3Q1U; session-id=19340a2b-79f9-4f20-8e8e-6dca3c76df9f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:08:37 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 243111\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"103a99831fc4a0c9d554204ec178922a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncontent-security-policy: default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: a3f4493369f949c5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":243111,"size_decoded":243678,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 216x216, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 825x819, components 3","md5":"103a99831fc4a0c9d554204ec178922a","sha1":"c3ad005c15c7fa467b9ce526cf09219d692ffc64","sha256":"5c3cfa49d73df066cf873c1b24980173b1c15c16a7671d78e0ad447b5a80b03d","sha512":"db4e208de01a0aeb374c52de9cb3f42e8c7fe220b92690619dcefffa074bd10d2aaa2d6c9a2b87093d5740aea71dd290a6607fde301b42d332c1c2c23614b906","ssdeep":"6144:sF6O0O92kYnOa1pBcln4TZivlij4vLYGCux8/:sF6O0O92dOa1pOokvlij8YG7u","tlshash":"463412beed87d361467f2aba905bbdcd13815fed00fc8e4945104d0a97ca7a08c8a4ed","first_seen":"2026-09-22T20:54:42.389324Z","last_seen":"2026-09-22T21:09:20.394999Z","times_seen":2,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":84,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"exedu.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"exedu.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.058Z","timestamp":1790111317058,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:55:16 GMT\r\nexpires: Tue, 21 Sep 2027 15:55:16 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 105201\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-23T04:46:53.524576Z","times_seen":295724,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":48,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.059Z","timestamp":1790111317059,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:55:16 GMT\r\nexpires: Tue, 21 Sep 2027 15:55:16 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 105201\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-23T04:46:53.524576Z","times_seen":295724,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":49,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1pL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.062Z","timestamp":1790111317062,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1pL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18940\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 16:17:30 GMT\r\nexpires: Tue, 21 Sep 2027 16:17:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:46 GMT\r\ncontent-type: font/woff2\r\nage: 103867\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18940,"size_decoded":19753,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18940, version 1.0","md5":"5c8b2708e9cd88a6c9e2172fd1a09d80","sha1":"f8da9a4c7fe5fbb441e8e1e2587f8e7e8e25bf8b","sha256":"20fc1e117a255531a9f1bfc780fa9827a22820f8e07560b155323dff5fd908f2","sha512":"d56292486b6274e3d0d5a00cfa19573469ac4d4173fbdc786cdede8d9e18b8eecba8aa647a115b32770feea0ac2d59c54092642863d4cc2ea725560435c6b780","ssdeep":"384:B5OeSmylzizCljGvu0333XLJyBo9/fsItLbLvAsik1LJ57o:BTylizClUpH9mo1UIt/Lykpno","tlshash":"3c82e0a7f1a24589d84b87c02098e7546967b70821d6acea411be4d90bdbf5e20ad32e","first_seen":"2025-09-12T00:27:30.877732Z","last_seen":"2026-09-23T04:07:33.56879Z","times_seen":3468,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":21,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:36.035Z","timestamp":1790111316035,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://exedu.site/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 22 Sep 2026 21:08:36 GMT\r\ndate: Tue, 22 Sep 2026 21:08:36 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15162,"size_decoded":1524,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b8d3b4b9d4ee8cae44e2afcef48e7a93","sha1":"ea3c361f22fa31fb8612dd2ca30f1ac7ba03f75b","sha256":"7c966efd5a04f87920e8cef5c332c73b0d529b21c46fa312ff0020047d882c35","sha512":"7418cc24da4237fed57bbd3e92618985c30c29ab320908f146d0fe954c6a49e179007537480bfc7f2bf76e76a47da055c6cb6fb2744991e0c3a471c88fc06f08","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGfNx0NO3kCxHYNCbOO3L+:vXuM0p2+g7GQK","tlshash":"c2628892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-11T12:17:30.699497Z","last_seen":"2026-09-23T03:36:48.073422Z","times_seen":5325,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":35,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exedu.site/","date":"2026-09-22T21:08:37.055Z","timestamp":1790111317055,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://exedu.site\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:55:16 GMT\r\nexpires: Tue, 21 Sep 2027 15:55:16 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nage: 105201\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-09-23T04:46:53.524576Z","times_seen":295724,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":20,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}