{"report_id":"48d2f0f5-50f6-4035-ab01-0279068e1fcb","version":0,"status":"done","tags":["swisspass","phishing","transport"],"date":"2026-09-03T14:18:40Z","url":{"schema":"http","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":0,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"final":{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"title":"Login | SwissPass","dom":{"size":13721,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c04cbd69f7e808b010fc0a573a2f342c","sha1":"beaa2abcf6aa01b4f92b95a3cfba063d78aa691a","sha256":"b71e189b01ddf5c0fedcb1310cee68c6ecf1b844b4162f02db31319fb2adc779","sha512":"6a010be301879817c9f5610d9cbba32ef07591f19b56aed20ee8f704bbd2996136b2f221d82d92b8328f04771c13aad59f5091e2a2ee42c8209c91910adb7fe5","ssdeep":"192:ZSwtkGNTBaOKMHDkA5phhRRS66kkiZFXRob3vsMOEEE+/5g21bGDe4r4QcmArPeZ:ZSwaJABcPoXiLUMribG/rvArmqE","tlshash":"7452622554f10833669380f82ae6db077e68d003a6474a107efc5bd89fdef829f17299","dom_hash":"domhashf26dfbc59bdb6e6263999e150655b1c5","first_seen":"2026-09-03T14:18:43.387614Z","last_seen":"2026-09-03T17:45:06.442409Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":0,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-08T14:18:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"summary":[{"fqdn":"erscstattungif92.site","ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"domain_registered":"2026-09-02","domain_rank":0,"first_seen":"2026-09-03T14:12:25.953855Z","last_seen":"2026-09-03T14:12:25.953855Z","alert_count":18,"request_count":6,"received_data":611890,"sent_data":3997,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/js/jquery1-2-3.js","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"introduction_type":"scriptElement","is_inline":false,"md5":"9fe7c3531b2125a7a17fe7f3ff6bab4c","sha1":"db72884fad2a4fc3256ea24045a07c647cbb580b","sha256":"6dafd158e1d1de2a15d394b5ceddf1688ba5c8250faf28c8b68e71f97129a518","sha512":"4b2c3e3c31099408e534711574e14d321dd245da1983c06c79a79cf393f6a2ab5625aaac8cf968b18698d7c8edfa352bd6c22c3e914b0e9168855c712a12af4d","ssdeep":"192:fM2YkIlKQZ1jNRi24y5ONaoPOUsdCBTzt0Y/I+n:k281zi1P7sda","tlshash":"a31245997ca214b16eabb8be37df41483a6440130805d9517c6c59095fb0f912bbfbfb","size":9119,"data":"","first_seen":"2025-05-05T16:25:28.190844Z","last_seen":"2026-09-03T17:45:06.45591Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"introduction_type":"scriptElement","is_inline":true,"md5":"50fcaa110ec3892145d56d688cfa4f34","sha1":"d82e524917f42e27044090f669b1f955d5144616","sha256":"d8ee88c652861fb4014b4a249ffd7a5ad049dbe3d3367b81d36c2d02979f6e03","sha512":"a35ed8b0e859e4cf6f944cf471bcc75dd47d1c47e068e2645cb9320232fc23e4cfcbb1799a3f132564fa5fd94d3c6518f5f002c234ae35e87baf8fc36a31d240","ssdeep":"","tlshash":"5b519eb93cbb04700aa7f6be27db52443435a017284689117f7c8b1c6ff6d4366626aa","size":3017,"data":"","first_seen":"2026-09-03T14:18:43.410405Z","last_seen":"2026-09-03T17:45:06.467607Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/js/jquery1-2-3.js","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","date":"2026-09-03T14:18:10.064Z","timestamp":1788445090064,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/js/jquery1-2-3.js HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 03 Sep 2026 14:18:10 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 10 Apr 2024 23:05:36 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 9119\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9119,"size_decoded":9368,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"9fe7c3531b2125a7a17fe7f3ff6bab4c","sha1":"db72884fad2a4fc3256ea24045a07c647cbb580b","sha256":"6dafd158e1d1de2a15d394b5ceddf1688ba5c8250faf28c8b68e71f97129a518","sha512":"4b2c3e3c31099408e534711574e14d321dd245da1983c06c79a79cf393f6a2ab5625aaac8cf968b18698d7c8edfa352bd6c22c3e914b0e9168855c712a12af4d","ssdeep":"192:fM2YkIlKQZ1jNRi24y5ONaoPOUsdCBTzt0Y/I+n:k281zi1P7sda","tlshash":"a31245997ca214b16eabb8be37df41483a6440130805d9517c6c59095fb0f912bbfbfb","first_seen":"2025-05-05T16:25:28.190844Z","last_seen":"2026-09-03T17:45:06.45591Z","times_seen":5,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":18,"send":0,"wait":18,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/img/logo_text19.svg","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","date":"2026-09-03T14:18:10.069Z","timestamp":1788445090069,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/img/logo_text19.svg HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 03 Sep 2026 14:18:10 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 18 Aug 2025 06:57:30 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 139971\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/svg+xml\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":139971,"size_decoded":140219,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"512410d9227bb0c2481e175dce0eda72","sha1":"1deb5d9f09592101e632a8351865d54b1d6a27f7","sha256":"c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07","sha512":"855feb227bb9448de654bf5c616a2dbf71c4f97550a00a30372cb0ae2f7b0bd70b7a4430d84c8386934b7064d8bc3f66e926b5b2dd9920812af96c3469743a86","ssdeep":"1536:mYtjakc0aZDT/Zs4sC0jfjR1YG+s2Ltt99ac0eW53zzVCoYs2rhrXzgEA6SJB5LQ:j5E2tvYkUv1","tlshash":"37d3a716436884e8b59f45f13cd41d0a2a5a98e723125919faae8c31dff3ef3d382b45","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-09-03T17:45:06.458522Z","times_seen":2258,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":69,"dns":0,"connect":0,"send":0,"wait":19,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/css/font/SBBWeb-Light.3f0cdd23274e17f7.woff2","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","date":"2026-09-03T14:18:10.180Z","timestamp":1788445090180,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/css/font/SBBWeb-Light.3f0cdd23274e17f7.woff2 HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://erscstattungif92.site/success-login/neues26a2sui55ss/css/style.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Thu, 03 Sep 2026 14:18:10 GMT\r\nServer: Apache\r\nContent-Length: 355\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":555,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-09-03T22:46:39.996919Z","times_seen":60836,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/img/favicon.ico","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","date":"2026-09-03T14:18:10.214Z","timestamp":1788445090214,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/img/favicon.ico HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 03 Sep 2026 14:18:10 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 02 Apr 2024 15:30:02 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 1150\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/x-icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1150,"size_decoded":1395,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"6d866d9c4568bf7fc03e597e74ce7e28","sha1":"e1b3d9f0e9cdcb785a94b6c1e1fe651a4ff98dcb","sha256":"7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677","sha512":"7dc58e58fc991e2c9310e22a6761aaa398586082c13fd7863fcadd48e15cef8ed7337dc33d0acc0d0b9b698d4d26abbbe6995fa48d2c9ce1161b2f39fea2a381","ssdeep":"","tlshash":"53215d85ffcbd895e413ed317a81e1862c584d61eab09d8130a1f4ebeb716744c54778","first_seen":"2023-05-05T11:25:27Z","last_seen":"2026-09-03T17:45:06.444591Z","times_seen":2776,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-03T14:18:09.788Z","timestamp":1788445089788,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245 HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 03 Sep 2026 14:18:09 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":13725,"size_decoded":13921,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8b3f2f6135add386c96b16e6a7bcfae6","sha1":"5c25729f45604823cac23ed78dceb100e7433d19","sha256":"19d48fe8c9c74f2898768319b38361e7ac5a03f350ac2c7aa806a119aea6860a","sha512":"23f0b72befc766f3101139cf5ffa80735630d4367b59f4f032ddfa7ad78b49784416a7ab91f281c15230ea4b0f1b49a14db732c6466e9e0ae47f9ba1d713db13","ssdeep":"192:zSwtkGNTBaOKMHDkA5phhRRS66kkiZFXRob3vsMOEEE+/5h2jbGDe4sFQcmArPeX:zSwaJABcPoXiLUMsgbGQKvArmqS","tlshash":"7a52612654f10433269380f82ad6db077e68d503a6474a107efc5be89fdef829f17299","first_seen":"2026-09-03T14:18:43.402234Z","last_seen":"2026-09-03T17:45:06.447147Z","times_seen":3,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":57,"connect":18,"send":0,"wait":22,"receive":14,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"erscstattungif92.site/success-login/neues26a2sui55ss/css/style.css","fqdn":"erscstattungif92.site","domain":"erscstattungif92.site","tld":"site"},"ip":{"addr":"5.61.91.73","port":443,"asn":20904,"as":"Cinia Oy","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245","date":"2026-09-03T14:18:10.063Z","timestamp":1788445090063,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.erscstattungif92.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 17:31:15 GMT","end":"Tue, 01 Dec 2026 17:31:14 GMT"},"fingerprint":{"sha1":"61:AA:A5:BC:D0:73:50:2C:DD:C9:8A:8A:31:68:C9:98:EA:E9:4E:0C","sha256":"A9:24:92:50:37:A8:4D:FE:28:50:6D:06:75:63:A6:9A:D2:0F:08:D7:83:7F:1B:FB:BC:42:C0:C1:06:5E:E4:8D"}}},"request":{"raw":"GET /success-login/neues26a2sui55ss/css/style.css HTTP/1.1\r\nHost: erscstattungif92.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://erscstattungif92.site/success-login/neues26a2sui55ss/aos566a2cd5a477w85a63c22a45.php?ID-connect?q=df\u0026ehome\u0026j-oin-us.x=4f3af663e8f3f174b161603e5af112454f3af663e8f3f174b161603e5af11245\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 03 Sep 2026 14:18:10 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 12 Nov 2025 23:10:30 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 446189\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":446189,"size_decoded":446432,"mime_type":"text/css","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (64079)","md5":"8f5d1c5c3f662d55bf19c99f4c1a2390","sha1":"6222db19b67c4e9b05016e521d521f8015390a77","sha256":"2064c563d7714f7fd856d0d430b098477e1418946d2c0bf95e856cbbe0636dba","sha512":"a332e99b1938d333f80e4f1285353c1665851b491a1ba0ea0019ff59bbfe0256c6b07fa9dc7459972a5e57aae761795091f80459eeea4ce62ba7ff6c80a85768","ssdeep":"12288:gFKLGCew1dsu4VGRhe8cm7e58zhYxDVW5YfJmct1K2qm18K2:gFKCCh+TyheHX589OM5Yy","tlshash":"8f946c92f570285ddd5f832860e07eab156b4243d2919debf417e7994b8cec20ba3e0d","first_seen":"2026-09-03T14:18:43.404915Z","last_seen":"2026-09-03T17:45:06.450047Z","times_seen":3,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"erscstattungif92.site","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"erscstattungif92.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}}]}