diff --git a/resources/views/hacker/xsleak.blade.php b/resources/views/hacker/xsleak.blade.php
index e9b9593..19ad697 100644
--- a/resources/views/hacker/xsleak.blade.php
+++ b/resources/views/hacker/xsleak.blade.php
@@ -88,7 +88,7 @@
         const startBtn = document.getElementById('start-btn');
 
         // Words we want to check against the victim's private database
-        const targetWords = ['guest', 'confidential', 'public', 'project_x', 'random_word', 'admin_rezvan'];
+        const targetWords = ['guest', 'confidential', 'public', 'project_x', 'random_word', 'admin_panel'];
         const THRESHOLD_MS = 400; // If response takes > 400ms, assume the DB did work (HIT)
 
         function log(msg, type = 'info') {
diff --git a/routes/web.php b/routes/web.php
index 2a47e36..e06f60e 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -142,20 +142,23 @@
 
     // ----- بخش‌های محافظت شده با سشن -----
     Route::middleware(['web', 'auth'])->group(function () {
-        
-        // XS-Leak Target API
+
         Route::get('/api/private-search', function (Illuminate\Http\Request $request) {
             $query = strtolower($request->query('q', ''));
-            $privateKeywords = ['confidential', 'admin_rezvan', 'project_x'];
-            
+            $privateKeywords = ['confidential', 'admin_panel', 'project_x'];
+
             if (in_array($query, $privateKeywords)) {
-                // Keyword exists: Simulate DB fetching taking 600ms
-                usleep(600000); 
-            } else {
-                // Keyword missing: Fast return 50ms
-                usleep(50000);
+                $hash = 'start';
+                for ($i = 0; $i < 100000; $i++)
+                {
+                    $hash = md5($hash . $query);
+                }
             }
-            
+            else
+            {
+                $hash = md5($query);
+            }
+
             return response()->json(['status' => 'search_complete']);
         })->name('user.api.search');