[popey]

Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube.

I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.

[jstanley]

What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make.

The only thing implicating that site is a redirect that you got from a site that you know you don't trust.

[popey]

Yes, I understood your point.