{"report_id":"049ba499-4c65-43a6-b630-975b26b03ef4","version":6,"status":"done","tags":[],"date":"2026-05-13T19:34:36Z","url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":0,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"final":{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"title":"E-finance login | PostFinance","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":0,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-17T19:34:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.postfinance.ch","ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"domain_registered":"unknown","domain_rank":272883,"first_seen":"2012-12-17T13:54:18Z","last_seen":"2026-05-13T09:18:57.612094Z","alert_count":0,"request_count":11,"received_data":8260,"sent_data":5015,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"127.0.0.1","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":40,"received_data":0,"sent_data":17420,"comment":"","tags":null,"fingerprints":null},{"fqdn":"bqztzw.postfinance.ch","ip":{"addr":"194.41.226.13","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"domain_registered":"unknown","domain_rank":3618034,"first_seen":"2021-11-22T06:40:28Z","last_seen":"2026-05-13T09:18:57.600954Z","alert_count":0,"request_count":2,"received_data":1414,"sent_data":1161,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"postfinance.buzz","ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-13T09:18:56.445913Z","last_seen":"2026-05-13T09:18:56.445913Z","alert_count":92,"request_count":23,"received_data":1190398,"sent_data":10990,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/prefetch_e398fbb2.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e7a3837a0e3788f15725d2327cb66f8","sha1":"eb777090acc56d4080ab64f26f3406b81f756c69","sha256":"e398fbb2fab9270e816fd2523841a0a4c40509d3813f32e793278644abb5fca1","sha512":"d8da8fa6415545a2907e37c0713ddb08c4784c27134917f366e05f4d17fc16b9c924757be20a13ef661a66d4015a5fe911bad34e6f58371ce54ad9ab97044997","ssdeep":"","tlshash":"f8f0a7b480521d1759c9bc4b6227b380740610566674c549f9cc5c74bfcabacb3465f3","size":470,"data":"","first_seen":"2026-05-13T09:19:02.833645Z","last_seen":"2026-05-13T19:34:43.909288Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/ib9157483.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"38a599c04c2f094b3441ebc30b4eaa1b","sha1":"d1b88e8087279fbffaa4588e9b354731605492f6","sha256":"7947203e39ecddc27ef9d3bf6ab9681d4540cda8daf6166381b0718bbb0ec4f5","sha512":"fd95ebb90eba146ba5340d69d645a8962b7567b26284a3e4046dddeee74b73c520785a11699035c025b860cec64d82e2d658c34da402057894ccec1ed921030f","ssdeep":"6144:2+cqqxa4s1HXQatfXUwXr68AYFo3bT6UPZdVuEZ:LcTgxtAatPU0MWUjV/Z","tlshash":"5d9409823f415613b3a76cbb307b0517a127bf26704dda78ebbbac472d18395a069d13","size":409031,"data":"","first_seen":"2026-05-13T09:19:02.832835Z","last_seen":"2026-05-13T19:34:43.927639Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"81894bd612f69d7435c2f4dc002f742e","sha1":"769e4aac46b80f046e91c26df8691dd9f17f053d","sha256":"ac905dda08b1cd5f3661bcdc09fc034adf1b31b6edae071aed2af9974adf13b8","sha512":"5d01bb324f8fa37bc7c92c6f575b8ea6981ab80accd711ac68d9207c6dfe4d72dd45df3e50cd714f1c7294c05214644f441852986270f94b88a3422e80d12973","ssdeep":"","tlshash":"10f0234c3c66b05337fd3a34c223ca7f3391070135839524ca05cc2438544860846c8d","size":445,"data":"","first_seen":"2026-05-13T09:19:02.839294Z","last_seen":"2026-05-13T19:34:43.939465Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"4e200714bdd2f852cd841087e8873a8d","sha1":"deb63a0cea950d2222d7bdf3bf882bedb7c05299","sha256":"54a875fe483d24be9268536594e87a9076e9affdcfcdf6428fc3b5a026ce3cb8","sha512":"aab87808a5e44dc46fa1dc318462ab0cb0f1e8b170637aeeb5a6ac1435f76466eb0986e0f1b2f971a91b42abf9003e0db1f4eb16990f8132e0245b42b8ba9224","ssdeep":"","tlshash":"59e02caa2ceb80208026201b137ae31a35a1202b1004e0093cecce2c6f90fdb8c14ea8","size":359,"data":"","first_seen":"2026-05-13T09:19:02.840102Z","last_seen":"2026-05-13T19:34:43.940371Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/statistics","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"b9ae222053e268478f4f3656e6a2b23e","sha1":"19abc3950c44116d2ec6ff65bc43fa2a78e1b2af","sha256":"8659e02e7751ae5be34d52f70c2282ddbbdcde1f367ba5431b986453cb6cd673","sha512":"bc93f1725988c799353b838d408755ddcaaf1b76937c6113cd07e47105852bcf97b115fa4c9a1d1d8f369a51a5d7aad14a4e57987c6f417ceba840e70ee3686c","ssdeep":"","tlshash":"557132722fc4290b5e2e6371737d420e4915b21f639803fb9c510fdadbc6a8d869b394","size":3656,"data":"","first_seen":"2025-08-13T06:33:18.962759Z","last_seen":"2026-05-13T19:34:43.913514Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/Initializer.min.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"5763edfcf8131e8af7757226bef0c9a2","sha1":"9a60f3115dea3c76acb878fbb2b769d98aab7af8","sha256":"c7155aa6a4d2d1d113b27543992e147fe8fd6d7328ade3156e1d4af17cea15e3","sha512":"2f2b9fdf389a116abdf09b1d1c6338598e2266a470be9813ffd3bc655159444abeab265e05c62aed18dc47c3684b8da7cf652c778be6b6158153e42e22fa81e5","ssdeep":"192:3XhO4Tc4oG+bN5JA4QI4xf5Upl9j4l4Cc37775dwKq0IXX0VsPUQW1/8Qt/5vwbT:nhFTc4o9bNvcxf5a9f77MKq0In0VsPU+","tlshash":"f7e185fa70d2e4321be804866773b111fa2a55293846e11df18ca9d23d25e478773ff8","size":7090,"data":"","first_seen":"2025-09-10T10:18:44.47019Z","last_seen":"2026-06-25T03:03:57.969082Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/SiteIntegrationLazyMain.cfg","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":false,"md5":"74bda695df8262316d2ca72ece43b884","sha1":"650be6e5311f12b70240ae2c95bb4471d73d9b17","sha256":"40137bc059e848f915d0380b0baf35d4946f3da374f0d585a05dcd9f728f67a3","sha512":"1cacb9c3f555bf6a0d933d5b6e15a757282e5be6f54fbe3390b7a6ac1a1493038eb0a51a594af472521e2b0cb4a65cc37e68dc3bc675d9037934f3ced41689a8","ssdeep":"768:1Cbyl7gQtPKpZr8981iVjgiF0amIs73NlNss82m+f7K58uQ0aVWaZ8jLEv/sTSdp:1I07ey+am773NlNl82tfq8/","tlshash":"85d2ce6c9a28cd1e164f01fb1a37f0c81378b0957113e663b36faea64f51e95ab07e41","size":28860,"data":"","first_seen":"2026-05-13T09:19:02.837227Z","last_seen":"2026-05-13T19:34:43.936642Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"b551da3111f4fc693bf311f00226a9d5","sha1":"fd38bca4e99bfe11b61020e77f4a59de54d4e404","sha256":"877e923c30faf1a5131e3726b2d17110569d7b8185d3ed51930cebb29cc337f6","sha512":"c298b12bf022d7c67cbe00d5d22655beec9d9af4d7565553e44fe747c2ef217c8583ea9d0e27e6caaa61d1da100bcbef8ab7e88ba913c3f9b1525f294f9be219","ssdeep":"","tlshash":"d8f0dd3e3fb830a288b719322369b105563385603408fe94b9941105ff84f78c2fae69","size":656,"data":"","first_seen":"2026-05-13T09:19:02.841026Z","last_seen":"2026-05-13T19:34:43.941303Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"0dba978dcc527bc5c537fdc815776da0","sha1":"34f37a9737ca2ab3ec716f057b3ed11dde8ca9a8","sha256":"53c2ff8e1e079143be8b0bd408d0abf56e5a4d9b2f3f495d0bde603763265568","sha512":"5e8b73ec8c2fb545851ca65e5f9d6257f60a20779292465e2f540de6392c29f1e7f669557a1047d0c7b771193baf30bfcbeab5d2e6d49653c49a840939a2f4c7","ssdeep":"","tlshash":"20415239427e182407a791578bcf37893630006f3646cb697f6d4f995fe5d2046e5bc8","size":2029,"data":"","first_seen":"2026-05-13T09:19:02.841809Z","last_seen":"2026-05-13T19:34:43.942154Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d8d72f52e4e57257130a3aa58843c5e","sha1":"e3b3b94c560bdd25bbfff4f13b4cdd3055175b42","sha256":"5d80320c3de35b7e14c95d2d3d2d9294e143c2e51bd6fbc2c0cf4824abc53f33","sha512":"4ef7fafe59eb60f4e4f1bf686137ab5d6d6ef53d89f9ea172cee33e1ecc07ee4ca94d3f1d6132154cae1cf1cb1f24c39ed1e0652c4c9d18c5a9bf82ebc4bff40","ssdeep":"192:1V+D3nBy+4egGFKi58rfYYx4oP3To12HBUT1hsHCTc:i+i80Vf8Kc","tlshash":"fbf1816a35fb18344cb7f07a4f9ba5153835002b21a9c6553d5c4b097fe0a92cbb5bec","size":8056,"data":"","first_seen":"2026-05-13T09:19:02.855071Z","last_seen":"2026-05-13T19:34:43.943217Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.196Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.104Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.250Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bqztzw.postfinance.ch/ap/ga/bb/prolong?sid=42kFV5crkP0lvYGtTANAfhwiCLMHnutm\u0026tc9g=VXqjSjEIf4X9iEJ2I7zlWmWwaP72ImQU","fqdn":"bqztzw.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.226.13","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:30.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bqztzw.postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 16 Oct 2025 09:07:59 GMT","end":"Tue, 17 Nov 2026 09:07:58 GMT"},"fingerprint":{"sha1":"EF:B3:C9:D3:BC:1C:21:87:C8:D7:2D:56:98:C2:C5:F0:F4:4B:83:8D","sha256":"DD:90:64:18:78:6A:16:94:E4:1C:56:F6:4E:E7:7D:A2:04:62:F8:B7:8B:9E:1A:63:A1:17:D6:CA:21:18:BB:A4"}}},"request":{"raw":"POST /ap/ga/bb/prolong?sid=42kFV5crkP0lvYGtTANAfhwiCLMHnutm\u0026tc9g=VXqjSjEIf4X9iEJ2I7zlWmWwaP72ImQU HTTP/1.1\r\nHost: bqztzw.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-type: text/plain\r\nContent-Length: 224\r\nOrigin: https://postfinance.buzz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":224,"data":"AgQryAemHwpyUWV9C0xeWFZsNA50Fxp3dxgYX0pncFp9a295VmRdSFhhbnVyQGh6ewdrVUBoX29USFIFHVdoD15JHAZ5GkVtZBRRbkczSHkdCAl1AwYZV3sLQGtGRWVEXEt6CwEIBAUBCwV2clJoYlVeXnxqYwNXdFFUQE93V1VGHnNGbBVQHzV/G0QFSG0pRH17WQV4ZVVfZGgpJAsKVVJuXC9tcA=="}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 May 2026 19:34:31 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 180\r\naccess-control-allow-headers: Content-Type,Authorization\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS\r\naccess-control-allow-origin: *\r\nx-correlation-id: INT-0248992c-fa1b-4fea-b9ee-4f2501e37ae1\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\nx-request-id: 8cf5529705f69a216f3cafde6b20198a\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":180,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6330c5d71bf3aba28a6b19458b31e8c1","sha1":"e96ff871f7a51a5a6627a47a5ed96e4e4118f3c3","sha256":"5abe2c7701b588112cb10f68d22211ee18bdd10d41e49424259bc07350645ee5","sha512":"547091d5a24dcdabf09f174ef728ecd9aab57b114dfa8e31b6b25e8a75c30ce33a81762fcc00d3a936ea7f8764ba71ee448619d6b9830ef3b454e33589765bd8","ssdeep":"","tlshash":"30c022026688b811260c8667071ec45a4325a0a72e38ebc8185d990b54222229e0f900","first_seen":"2026-05-13T19:34:43.895845Z","last_seen":"2026-05-13T19:34:43.895845Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":68,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/image/cardreader.png","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /image/cardreader.png HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 14359\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-3817\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14359,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 110 x 110, 8-bit/color RGBA, non-interlaced","md5":"3990390f753daefb95c2798d35188bff","sha1":"d49fd65285bace3354eb89d61178b4a232a4839e","sha256":"f23f354af5b6a19b849d3c5b280653c5b304f4913c679f448aaeb0c434c4ad55","sha512":"26cf99bd1fee6e11e4852cad94a648d0cea6f44ab7760e929dac52ec3f2c71d8232f8bb5539b4696ac7a98bf786ae912de81ce5ad0e31f9756cb91cfff4dbae9","ssdeep":"384:bNUKv+yHqDIdlHWy35iEfZ5XWu23tIQVW+0x8Bq:bNxWCUIdlVPZ5muU0xF","tlshash":"0e52d01cbbbb93c1638720a28f9a816511fb4b4999c4578bbb7c04594f7cc1a11ce3e7","first_seen":"2026-05-13T09:19:02.828336Z","last_seen":"2026-05-13T19:34:43.898241Z","times_seen":2,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.083Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.179Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.187Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.215Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.223Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.245Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/image/bell.png","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /image/bell.png HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 568\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-238\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":568,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"43d99d54c104228560d38186161c111c","sha1":"8fb7f496ff088e752ac25b3e5cd6b35eccd7e22e","sha256":"06d2c2c29183384f7272b21a016b42d6714578b4b007bf4336c299bc8f6b0f52","sha512":"ec43a973018f7583bc0d52ce545a593cf91d904e258ee5b051742026bab505b123d91b22575449814803ccb88add17ccb2b3d024d613f6990bbb1a2f158ef2c0","ssdeep":"","tlshash":"3ef041968b1e411e834a3cb79d0f05cce0ab0e85915dab509020d8b2a9785a474f4e76","first_seen":"2026-05-13T09:19:02.834483Z","last_seen":"2026-05-13T19:34:43.902698Z","times_seen":2,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.053Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.087Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.105Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.170Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/styles-LT2R4SOA.css","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/styles-LT2R4SOA.css HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/css\r\ncontent-length: 389210\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-5f05a\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":389210,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4646f3c83e9479d96dafd587df9b6f96","sha1":"87d5ac38e4a53a87dee5777084d4acaa4c4db029","sha256":"4435c5c2f4b0b5369a2502d8eb22247cb32775250d69ee431cc1dde91bf06856","sha512":"90bbb05631986992df416f50c5d40d24c35a5e82f42ff0324c7bbc41f7b5c653bb25e9ed0f59d921efc59930db4ec0778254c11def6cc7bc102ec4e224708581","ssdeep":"3072:b83cgAXPGMUxHe0CEJ7DcDrX94bbUPpZZm6aQqPuTX5Q3:w3cgAXPNqPuTq3","tlshash":"8684d718fe10237f7917837997d5f6d8a118a443cf224bf1b50ea4278acfbe6166b844","first_seen":"2026-05-13T09:19:02.813449Z","last_seen":"2026-05-13T19:34:43.905693Z","times_seen":2,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":108,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.161Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.204Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/prefetch_e398fbb2.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/prefetch_e398fbb2.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 470\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-1d6\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":470,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"1e7a3837a0e3788f15725d2327cb66f8","sha1":"eb777090acc56d4080ab64f26f3406b81f756c69","sha256":"e398fbb2fab9270e816fd2523841a0a4c40509d3813f32e793278644abb5fca1","sha512":"d8da8fa6415545a2907e37c0713ddb08c4784c27134917f366e05f4d17fc16b9c924757be20a13ef661a66d4015a5fe911bad34e6f58371ce54ad9ab97044997","ssdeep":"","tlshash":"f8f0a7b480521d1759c9bc4b6227b380740610566674c549f9cc5c74bfcabacb3465f3","first_seen":"2026-05-13T09:19:02.833645Z","last_seen":"2026-05-13T19:34:43.909288Z","times_seen":2,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/statistics","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/statistics HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-length: 3656\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"e48-65185e9b8e523\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000;\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3656,"size_decoded":0,"mime_type":"text/plain","magic":"JavaScript source, ASCII text, with very long lines (435), with CRLF line terminators","md5":"b9ae222053e268478f4f3656e6a2b23e","sha1":"19abc3950c44116d2ec6ff65bc43fa2a78e1b2af","sha256":"8659e02e7751ae5be34d52f70c2282ddbbdcde1f367ba5431b986453cb6cd673","sha512":"bc93f1725988c799353b838d408755ddcaaf1b76937c6113cd07e47105852bcf97b115fa4c9a1d1d8f369a51a5d7aad14a4e57987c6f417ceba840e70ee3686c","ssdeep":"","tlshash":"557132722fc4290b5e2e6371737d420e4915b21f639803fb9c510fdadbc6a8d869b394","first_seen":"2025-08-13T06:33:18.962759Z","last_seen":"2026-05-13T19:34:43.913514Z","times_seen":4,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.177Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.197Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.212Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.230Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/unblu.interceptor.min.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/unblu.interceptor.min.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/media/PostFinanceGrotesk-Bold-HPP7CYRK.woff2","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/media/PostFinanceGrotesk-Bold-HPP7CYRK.woff2 HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/E-finance%20login%20_%20PostFinance_files/styles-LT2R4SOA.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ok/lr/assets/favicons/apple-icon-180x180.png","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ok/lr/assets/favicons/apple-icon-180x180.png HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: image/png\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Wed, 22 Apr 2026 12:22:06 GMT\r\ncontent-length: 1691\r\ncache-control: public, max-age=25920000, s-maxage=25920000\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d24911644eee6fd207ef6c7a\r\netag: \"69e8bd6e-69b\"\r\nx-envoy-upstream-service-time: 0\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cef9a485aeb1847d750952188bed1028409dc82c9afd5005d715d9e88774837b1b912490dfac470c4d21b818abf30206954; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1691,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit colormap, non-interlaced","md5":"fd5bc4e099fe83b7588e235a9f7d2f0c","sha1":"d542d0c9f36b0498e038c2f75e422d31b26ddfe1","sha256":"759ed5fd6f9cda517d982d84015104769eeb312d5f68bb5ccd2cc291a86be9b8","sha512":"df5fd58806fc7c02f8049f4dffc019f2050d7a3a467517c2e786350e7fc7688abbd84730f5daaa9f730cd94eb803a1aaddad28171137aa46b21bdf3601fabcc8","ssdeep":"","tlshash":"67311d90ff3135fba798443e0e585bb5d717437980b434db81ddb15e142f314108656c","first_seen":"2025-08-13T06:33:18.990412Z","last_seen":"2026-07-18T14:45:15.418548Z","times_seen":18,"resource_available":false,"data":null}},"time_used":636,"timings":{"blocked":-1,"dns":67,"connect":49,"send":0,"wait":53,"receive":13,"ssl":458},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-LGSTJKSQ.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.912Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /cc/ob/html/chunk-LGSTJKSQ.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/main-7YYLU4O6.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/main-7YYLU4O6.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52de3e1cb0dd2435d074495c1c\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cef2950611736591467017e72cf552e05d713e7b031ad49b465507294779bde268d90fdbd6ee77866cfef4667b0acfd470a; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":1553,"timings":{"blocked":739,"dns":48,"connect":40,"send":0,"wait":68,"receive":4,"ssl":645},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.073Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.094Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.117Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/unblu.integration.component.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/unblu.integration.component.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/visitor.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/visitor.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/Initializer.min.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/Initializer.min.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 7090\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-1bb2\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7090,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7089)","md5":"5763edfcf8131e8af7757226bef0c9a2","sha1":"9a60f3115dea3c76acb878fbb2b769d98aab7af8","sha256":"c7155aa6a4d2d1d113b27543992e147fe8fd6d7328ade3156e1d4af17cea15e3","sha512":"2f2b9fdf389a116abdf09b1d1c6338598e2266a470be9813ffd3bc655159444abeab265e05c62aed18dc47c3684b8da7cf652c778be6b6158153e42e22fa81e5","ssdeep":"192:3XhO4Tc4oG+bN5JA4QI4xf5Upl9j4l4Cc37775dwKq0IXX0VsPUQW1/8Qt/5vwbT:nhFTc4o9bNvcxf5a9f77MKq0In0VsPU+","tlshash":"f7e185fa70d2e4321be804866773b111fa2a55293846e11df18ca9d23d25e478773ff8","first_seen":"2025-09-10T10:18:44.47019Z","last_seen":"2026-06-25T03:03:57.969082Z","times_seen":30,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/SiteIntegrationLazyMain.min.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/SiteIntegrationLazyMain.min.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/image/info.png","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /image/info.png HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 626\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-272\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":626,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"c1a7e3d0a4ed077be2aedd94bdfe2852","sha1":"db10b35551959b563fbece171f55f582c2583870","sha256":"a2e8f51f89564eff4c964d2d69bef16ae3eae9f6334794b0a08acde47b339ce7","sha512":"30f5ee85b26c466023a3f58ec5fa119a98cc48f553ab3ca594d05d270e6ac9368e488837f5bb134c575babf60a9b66630217651ad08fb7230b23b498a8755197","ssdeep":"","tlshash":"1ff02dc372116c2a4ea540720a1382b6efba891efe01284d5603c5618f260891870324","first_seen":"2026-05-13T09:19:02.814725Z","last_seen":"2026-05-13T19:34:43.923179Z","times_seen":2,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/media/PostFinanceGrotesk-Regular-82-AFB3FOFH.woff2","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/media/PostFinanceGrotesk-Regular-82-AFB3FOFH.woff2 HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/E-finance%20login%20_%20PostFinance_files/styles-LT2R4SOA.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-3DLI3E65.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/chunk-3DLI3E65.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d2243273c4d8e42e7b6cecf8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11ceff052dfaefa86301c1c6aafcd5b2f497647de13bfbaa44ebfd0a62be9d00cfffd88e298a6ea5f8f9b37153f40a6321685; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":1180,"timings":{"blocked":543,"dns":0,"connect":0,"send":0,"wait":128,"receive":64,"ssl":445},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-2Y2KEB6R.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.904Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /cc/ob/html/chunk-2Y2KEB6R.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.075Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/assets/sprites/menu.5f99e462b66c186df6ae.svg","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /assets/sprites/menu.5f99e462b66c186df6ae.svg HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/styles-ZX7W5FRE.css","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/styles-ZX7W5FRE.css HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52de33d2a7b03c3eda4342b49a\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cefe45a7de62a64ce9a7791cae75d7b6654fbc6ac0d0e3647fff7bf470531fcf86ac66a7f1740abf42b2ef1171a65a7f53e; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":1550,"timings":{"blocked":737,"dns":47,"connect":49,"send":0,"wait":68,"receive":4,"ssl":642},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-M5SXX6UV.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/chunk-M5SXX6UV.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d22a6f2264ea005e3ebe4f14\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cefddaa99de8db4a9f54a24cc21a1820ea6c35c9a17a92e61503b4470fb7986e3ad6902d5ecbd9748399bad1101159c61ff; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":756,"timings":{"blocked":534,"dns":0,"connect":0,"send":0,"wait":148,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.169Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.243Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/polyfills-5FDKUQTZ.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/polyfills-5FDKUQTZ.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-2P4AYMJS.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/chunk-2P4AYMJS.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d2170f6b565dc69426984ad8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cefb4fe68af8ec13ce7e236c0ae35d2c85552e73f084f72d4ff0987925d9ebd7f23e3d48136c602ae8dd90aeaff1d5dea40; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":604,"timings":{"blocked":535,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.034Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.059Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.221Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-13T19:34:13.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 74010\r\nlast-modified: Tue, 12 May 2026 08:17:53 GMT\r\netag: \"1211a-6519a7feb1b57\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000;\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74010,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7039), with CRLF line terminators","md5":"db1cfe4dd4d9260ef61f80fc4477386d","sha1":"85281f2a3d1016dbea1e4fae9616e0d95048222a","sha256":"c5bab040ff5b10feffebd13fd677c80cfb0e33fb3f973736efc118c5fa8ca5f1","sha512":"5c838d2006cf05e9e880fb2ce52f1f670715749530b371a983e5a92e436dce7ee65e23c4f966e6b0b63ba49b8b035763c0e92e6ae6a5604f3ba9f3451e66225d","ssdeep":"768:7uuDHL9fDhdevJeJB0gvu0Zx9L/FvyM4MOeBudTFBuQMbogPmsCa57QZVCxR3Nl2:7uuDr9TeAx9LVyFBLwbnPmsCM7jDoMo","tlshash":"c473c723a8580e2b2133c3ea65b1f719f466c517c6478698faac175b1ff5c2049af3d8","first_seen":"2026-05-13T09:19:02.836331Z","last_seen":"2026-05-13T19:34:43.924783Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3387,"timings":{"blocked":1645,"dns":1352,"connect":271,"send":0,"wait":44,"receive":47,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ok/lr/assets/favicons/favicon-16px.png","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ok/lr/assets/favicons/favicon-16px.png HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: image/png\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Wed, 22 Apr 2026 12:22:06 GMT\r\ncontent-length: 374\r\ncache-control: public, max-age=25920000, s-maxage=25920000\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d2023b8f455665922b2677ce\r\netag: \"69e8bd6e-176\"\r\nx-envoy-upstream-service-time: 0\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cef4c4e8e3ddc688b68c71e5f30f683950b9699bd3d3f66ec9fea807a2505372d17067c7af09c88e0de3f401c7e415c307c; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":374,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"42699dbc481c404297f14df7c80cc66d","sha1":"a328f196636e3a1ee4232054426d4d110895e3e4","sha256":"6964ed421382aea8fe6938153a93afbd6d8491fb7aec9a1d4b9936a02563f6d7","sha512":"4628e95f8f9ff28ad959ac28b8a46c8a944b7d05f36c4337d0507f1ddc17c45f7eaef09bab8a316be5236aa9909cb08525dd83715dd385a02ed4e389b254a782","ssdeep":"","tlshash":"69e0c05327d13c34d8c8066303048c70ef4c826755f108dbacc78892758e34483c8f45","first_seen":"2025-10-21T08:19:14.353421Z","last_seen":"2026-07-20T05:11:57.335486Z","times_seen":18,"resource_available":false,"data":null}},"time_used":616,"timings":{"blocked":-1,"dns":66,"connect":49,"send":0,"wait":51,"receive":0,"ssl":452},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/bs.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/bs.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/ib9157483.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/ib9157483.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 409031\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-63dc7\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":409031,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65531), with no line terminators","md5":"38a599c04c2f094b3441ebc30b4eaa1b","sha1":"d1b88e8087279fbffaa4588e9b354731605492f6","sha256":"7947203e39ecddc27ef9d3bf6ab9681d4540cda8daf6166381b0718bbb0ec4f5","sha512":"fd95ebb90eba146ba5340d69d645a8962b7567b26284a3e4046dddeee74b73c520785a11699035c025b860cec64d82e2d658c34da402057894ccec1ed921030f","ssdeep":"6144:2+cqqxa4s1HXQatfXUwXr68AYFo3bT6UPZdVuEZ:LcTgxtAatPU0MWUjV/Z","tlshash":"5d9409823f415613b3a76cbb307b0517a127bf26704dda78ebbbac472d18395a069d13","first_seen":"2026-05-13T09:19:02.832835Z","last_seen":"2026-05-13T19:34:43.927639Z","times_seen":2,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":73,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.097Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.229Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/main-OUKKERIO.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/main-OUKKERIO.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 247339\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-3c62b\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247339,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (13350)","md5":"d65551a26fe99a12ed0f24b45339f8f4","sha1":"7b07e144e5335e4db42f891c52c9fe11079e8179","sha256":"7f3f15de57c8a764fd1279a2d145d51881fc9ec7bd95668a048512e0ad5b4d51","sha512":"92bf419c34148b928c6947ac0c75191cb268a5c09dce102656f1865156d997074218eb685278495493183adcc5de899c0c4f5a8ad192d62549551d0f5125e6aa","ssdeep":"3072:hjHkgJ4xW+W2hUrSK3yPlZhqt0iGjnHjn+MLKVkzIUiOKZrA7HF6NcopUr6nkTPB:BfiiGjnkY6Ncojpmh5f63nU6TX+Mvu","tlshash":"e8343b5aaa465c3f57c3529c68c30a05736c4445910ccd1eebb48d9a2bfeac5b2af33d","first_seen":"2026-05-13T09:19:02.829317Z","last_seen":"2026-05-13T19:34:43.935475Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.042Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.205Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/chunk-EDKRM2KE.js","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/chunk-EDKRM2KE.js HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/E-finance%20login%20_%20PostFinance_files/main-OUKKERIO.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.152Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.189Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.237Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/SiteIntegrationLazyMain.cfg","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/SiteIntegrationLazyMain.cfg HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-length: 28860\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"70bc-65185e9b8e13b\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000;\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28860,"size_decoded":0,"mime_type":"text/plain","magic":"JavaScript source, ASCII text, with very long lines (28739)","md5":"74bda695df8262316d2ca72ece43b884","sha1":"650be6e5311f12b70240ae2c95bb4471d73d9b17","sha256":"40137bc059e848f915d0380b0baf35d4946f3da374f0d585a05dcd9f728f67a3","sha512":"1cacb9c3f555bf6a0d933d5b6e15a757282e5be6f54fbe3390b7a6ac1a1493038eb0a51a594af472521e2b0cb4a65cc37e68dc3bc675d9037934f3ced41689a8","ssdeep":"768:1Cbyl7gQtPKpZr8981iVjgiF0amIs73NlNss82m+f7K58uQ0aVWaZ8jLEv/sTSdp:1I07ey+am773NlNl82tfq8/","tlshash":"85d2ce6c9a28cd1e164f01fb1a37f0c81378b0957113e663b36faea64f51e95ab07e41","first_seen":"2026-05-13T09:19:02.837227Z","last_seen":"2026-05-13T19:34:43.936642Z","times_seen":2,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/image/call-me.png","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /image/call-me.png HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 8260\r\nlast-modified: Mon, 11 May 2026 07:44:13 GMT\r\netag: \"6a0188cd-2044\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8260,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"a1cc7e6c3da887d2bc0ca05621707e11","sha1":"fcb38102da98f78c8aa5d6c2065bcc77edbb977f","sha256":"df9d5a16a86e43fcbf5a502445585a517bade7f972667405a2e651266deb95d6","sha512":"ba3573615bbd8ff7a2d8a3ccda2a5e3b1e8fb49f519c4b8a8ed2bddd437ce4bc7cc6259c36006b84af83e36f3b267988b12c8fbdaef079ba1e131084de3741a9","ssdeep":"192:yflMXHT5uF+On3wJEYN178kGhoYJkVSLxSnYy58rRxkDd1XN/g:QlM3FuF+OAJEmfXY1xYF6qrNI","tlshash":"a602b0c369b9d9648435fd111f8f5fdf20d0e2ebaf33400a54817537a04a58f4c6b625","first_seen":"2026-05-13T09:19:02.838373Z","last_seen":"2026-05-13T19:34:43.937619Z","times_seen":2,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.114Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.236Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:7070/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.061Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:7070\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.066Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.buzz/E-finance%20login%20_%20PostFinance_files/stats","fqdn":"postfinance.buzz","domain":"postfinance.buzz","tld":"buzz"},"ip":{"addr":"152.232.9.82","port":443,"asn":7738,"as":"V tal","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:15.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.buzz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 11 May 2026 06:52:00 GMT","end":"Sun, 09 Aug 2026 06:51:59 GMT"},"fingerprint":{"sha1":"99:57:EE:91:05:37:A3:30:A5:AA:AD:7F:3C:8C:4C:FA:E4:80:AD:17","sha256":"C6:61:86:C8:E4:74:CC:BF:A3:76:13:A9:67:B0:7D:02:F2:B4:F6:BC:38:D6:8F:4F:9B:27:FC:5F:17:62:13:6F"}}},"request":{"raw":"GET /E-finance%20login%20_%20PostFinance_files/stats HTTP/1.1\r\nHost: postfinance.buzz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 13 May 2026 19:34:15 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-07-26T09:14:26.638442Z","times_seen":110214,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-13","alert":"Sinkholed","trigger":"postfinance.buzz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-HGA6YTUI.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.166.21","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"FF 3072","signature_name":"RSA-PSS-SHA512","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"SwissSign RSA TLS EV ICA 2022 - 1","organization":"SwissSign AG"},"validity":{"start":"Tue, 28 Oct 2025 05:34:44 GMT","end":"Wed, 28 Oct 2026 05:34:44 GMT"},"fingerprint":{"sha1":"04:20:8A:61:84:43:68:1E:4A:5C:A9:CD:8F:64:69:1F:62:F2:30:6F","sha256":"3C:77:46:34:E0:C8:20:27:2D:08:79:B3:20:80:9E:07:38:3F:E7:65:3A:EB:76:94:2D:27:D8:6C:CD:03:A6:2A"}}},"request":{"raw":"GET /cc/ob/html/chunk-HGA6YTUI.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 May 2026 19:34:16 GMT\r\ncontent-type: text/html\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Sun, 15 Feb 2026 09:19:35 GMT\r\ncache-control: no-cache\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx_ok_trid: 19e22d52d29e809de0433a7a5db4929c\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpires: Wed, 13 May 2026 19:34:15 GMT\r\nexpect-ct: enforce,max-age=2592000,report-uri=\"https://universal.postfinance.ch/report\"\r\nset-cookie: TS01e5530f=01c2c11cefc3a2c2edb484a402d80065eef5568026000e600e21d230efdc25d28c9fea9ebe55231231422ce7123382c3b020fbf42e; Path=/; Domain=.www.postfinance.ch\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":1135,"timings":{"blocked":544,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":450},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.postfinance.ch/cc/ob/html/chunk-GSJY6UIB.js","fqdn":"www.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:16.910Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /cc/ob/html/chunk-GSJY6UIB.js HTTP/1.1\r\nHost: www.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bqztzw.postfinance.ch/ap/ga/bb/prolong?sid=42kFV5crkP0lvYGtTANAfhwiCLMHnutm\u0026tc9g=VXqjSjEIf4X9iEJ2I7zlWmWwaP72ImQU","fqdn":"bqztzw.postfinance.ch","domain":"postfinance.ch","tld":"ch"},"ip":{"addr":"194.41.226.13","port":443,"asn":12511,"as":"Die Schweizerische Post AG","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:20.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bqztzw.postfinance.ch","organization":"PostFinance AG"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 16 Oct 2025 09:07:59 GMT","end":"Tue, 17 Nov 2026 09:07:58 GMT"},"fingerprint":{"sha1":"EF:B3:C9:D3:BC:1C:21:87:C8:D7:2D:56:98:C2:C5:F0:F4:4B:83:8D","sha256":"DD:90:64:18:78:6A:16:94:E4:1C:56:F6:4E:E7:7D:A2:04:62:F8:B7:8B:9E:1A:63:A1:17:D6:CA:21:18:BB:A4"}}},"request":{"raw":"POST /ap/ga/bb/prolong?sid=42kFV5crkP0lvYGtTANAfhwiCLMHnutm\u0026tc9g=VXqjSjEIf4X9iEJ2I7zlWmWwaP72ImQU HTTP/1.1\r\nHost: bqztzw.postfinance.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-type: text/plain\r\nContent-Length: 1576\r\nOrigin: https://postfinance.buzz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1576,"data":"AjgcZAvV2aaVGsp6FY3DAh69SLtWWdNYXlZBp+D6OAhxxWN0j++CMlopZ3e1sTBw850SvqANTKOVWh0uTC9NbhYaNgJJTxwKcyBBSV9CblpTPHhFYnRGRTNyaFJ0fG5+ShdNUWZYX0hLfVVDG3ZbSn4CVVNGSh9+QFNHYQBOdRoRS2hVIyE/BmZGEERHdBw0LxFAaDhxYVU4GCYdXEsFQ1ViBys8K110bQgCaFVVZ2QmSGALbwdnemNeGiV4QwkQNQQVMTUGLhUUZz9TRVJsP102RAs7CiNYX2YZYUdDR0Jef2hwKHdSXmh+eitwcEBENkI9Tkg1BU1tQQEnAWBed0FvMgRyb2YgAC8pDHNOezZCEG9XDh0/PwkJI3UAQl50SiIPIyAfBCVvGgxrAXRcWAx3A1EIDlJKVRdsAm9LJBl+Z0VYaFVhcz82LSYYelpDQHRdQgJFYQ4vKFAPXkhmVgdVYFhLdHtAWEBPIhAVJg1vEC5Xdg8OSiQSGEpecG1xY3NFRD9iFVwDLjg7NHYQPwdDdlEAWGAAKVZ1cV83cU84SiMpYSIGaXhtJxdPP3kSGQEXQ1MYSV1rSXh2eW0xf0hvMApyI0NKXFAsGwQcVhcOOSZaTwcRMgYMLCJBZGZpI0xOfikkDSdTKVwsdy91Z2lYP1EIKzgmQjpKEyc1ESF3WVVYRGdIIwsnERFKexBmJU5SWHcCOF1VLQ1nNg9eHgICOQMUJA5RYRA2T21wMFYpFFEwP1Z3LgdldRUFBR8kbxUgLWgIVQcqS11cZ24WFW56UD42VzJcFGxrV1lDU3QaD1w9U0RFAhFzViMkGhNlZg1RW11ICh0JfF9mRH11VmgHWmx4JQFFV19PKVYTVVopGAU7OV1HPUpoEgN/WnxwDlc8Kis8A01rVwVgFk5SKyRfdEAQNQhhXRQdeGtMSnwXYxQRGykgFUl3GnNFaioyVgJXe05BJgw6JTQPEB0xf3YVDQwHDAoLDgQFIyYrOGRaShUBektjbjgAQhRQBBA8PycDTTdWB0ZrbwcvNThrJzwxFygzdE9OJGRMCkB0DxEDHSokOkg3HiwSOFEyTg1BG2RPJlRxSWxTFygSAgcQKDM/WQhIAignaFlDO1UuBFo7B15ROUoUTkQBXk4MQXwxAhoDBlZePkI3CQ82Th4xEkYeWVxHLRdbHGVeRxFAMHRYQDtdBgpQNxAqCmohVgh4WGU2JxlHfz0TI0EeNUsTRQEAF35vMXAxRSxYERs1QBYeVRdZYE4RbjQGADtcAAciESgAZAMOAXp6YAdVN0ZaQDZQez4/SSJRRlVSahEOFiUvIRZPBScLC0ViJhoWKikTV1kQPUFAAjxYCkVEAiotJQEAPjlaCREQZmJvBCIfDlkcFAFWK04UbW5QQVgLLXEmA3hOQkAlNEl0M1JgSklbBDJQS0kfECQdTnNsAgRDU3tWTBhuTlsYeyU5QF9hVlIiG0oDVV5zDT5jeHgYa0EfawoUCjIRBS8sHCBRfWsFCxBuVDEVDCVbJiorYD8OfnMOe2hvFEFtVwNNWlcaQWlsV09/EjwIEVdQbF4tb3I="}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 May 2026 19:34:21 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 196\r\naccess-control-allow-headers: Content-Type,Authorization\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS\r\naccess-control-allow-origin: *\r\nx-correlation-id: INT-36e8b71b-730c-45e7-9c53-f111cee6a755\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\nx-request-id: c33169ce9219b8c1d10117498796d0bf\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"cafcced9eef8b01ab6d4d0965a842f49","sha1":"0c9b8c997f4244849ce46b19f5d18ac193c0d208","sha256":"86d88a1931f6843aaa3c556609203bc5d2c2805b3e5d0974441f9c5cf3ee5df9","sha512":"49035216cb048f41ccd74d5c6ad01d196d8fb2e80c560877f3bd26c350fc41ee6b4fb9e0844e2a48abc4c8c532f66119d335ab6392bfe33f596f4994b07b5f35","ssdeep":"","tlshash":"83d0c0ca7737b714c8c0049024333011de61fd43cc1c2319d2160d2be0acf39dd92510","first_seen":"2026-05-13T19:34:43.938557Z","last_seen":"2026-05-13T19:34:43.938557Z","times_seen":1,"resource_available":false,"data":null}},"time_used":474,"timings":{"blocked":163,"dns":64,"connect":37,"send":0,"wait":146,"receive":1,"ssl":59},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"127.0.0.1:63334/sample.png","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.buzz/","date":"2026-05-13T19:34:26.050Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /sample.png HTTP/1.1\r\nHost: 127.0.0.1:63334\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.buzz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}