{"report_id":"6991968a-d6b7-4b16-815a-ae3b21866c61","version":0,"status":"done","tags":["swisscom","telecom","phishing"],"date":"2026-08-04T14:26:20Z","url":{"schema":"http","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":0,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"title":"Swisscom Login","dom":{"size":19815,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17300)","md5":"3bf79b5e9b34fed3c6f35b399e54dd56","sha1":"299a89604372cb0eac18601f016e5052d24aa343","sha256":"3fabb4596f71a0f5e1923f1d19566522903f734d42da6154f53a32847454fb49","sha512":"05f21b6603a92cae1397bf050cc9063478938a3cf59aeb601c129361301bde3005bfa5b788f8f294c53ea65090ea131e8e9ecc3331975a0244062ac30b3095d5","ssdeep":"384:780ZMVM0FMVM0BMVM0uMVM0gMVM0ZMVM0LMVM0ANspuoamIQOiu:JMVM6MVM+MVMfMVMnMVMsMVMUMVMvspm","tlshash":"ce92bedb548272698d175e6343cc191c99389ea34a525d9eb22e1409afc7ff823d333b","dom_hash":"domhash7d6f9dd20fc7a1a40a0fa880a4fe0b62","first_seen":"2026-07-09T00:48:48.8618Z","last_seen":"2026-08-05T04:15:31.409133Z","times_seen":6,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":0,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-08T14:26:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"summary":[{"fqdn":"nieuwestep.nl","ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"domain_registered":"2020-09-17","domain_rank":0,"first_seen":"2026-02-16T23:54:47.549198Z","last_seen":"2026-08-04T14:26:18.613144Z","alert_count":42,"request_count":14,"received_data":502280,"sent_data":8067,"comment":"","tags":null,"fingerprints":[{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-02T22:20:16.100749Z","alert_count":0,"request_count":3,"received_data":65687,"sent_data":1649,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-02T22:44:21.067894Z","alert_count":0,"request_count":1,"received_data":1465909,"sent_data":506,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-02T22:23:34.841384Z","alert_count":0,"request_count":1,"received_data":8946,"sent_data":541,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","size":23176,"data":"","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-13T16:46:01.416898Z","times_seen":4234,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"40bd440d29b3a9371b0c63fec41ee64f","sha1":"e790c26449c57de298923c686cb3434d1d461a1d","sha256":"dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48","sha512":"50326d2577f37ec88f3e09c8e52d74d3414f2c11cc86fcc0317d7923ea86d84d8e0330bd3f527353024e7e7ca95e2387ecc44f6aace13db0460cd363ef305fa0","ssdeep":"","tlshash":"4751a8857062714a8b2f11ab917f970ff5e452a6d8580060d0e9c87cf930df8c2bbf65","size":2730,"data":"","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-13T10:31:01.634682Z","times_seen":1833,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/respond.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"78915bb8b3dd6696d3842d82ed48b104","sha1":"504cce482567765d63843d7b9d00c4195109c449","sha256":"1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e","sha512":"fae71ebe045ce6a2c190b47bda2a0dd9f042c659c8225f566a31ddf1872de61048b99efcb9d9dfb02860e5304940b30c1dfcfdc00c96424f6e97374738139fcf","ssdeep":"96:fmeKAql8GALKZ2sdX0MVrpezoG3+gTYkhs7/tQMBze2EOgSUHB75h0:fnqSGTZbvVrpezoVgdSjtQMle2EOgSIc","tlshash":"a891c8a422203548e2ea3825967f4226f8739cb575584890d515e8b83da8fed10f7ff7","size":4593,"data":"","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-11T09:08:04.249231Z","times_seen":468,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0b7e001e9f8a42f5ac1c1cd612b4a66","sha1":"9ff3cfb2e15856f9b77bdda2661876614f46a245","sha256":"75ca5d1ab7947e7c19b4914a8ebaf31f5ef8547fee7fe3c4b49125fa9159fee4","sha512":"c858d96d3611089a1d9eec8696c29a98d13f2e511a100c525037b9faeeb5995f33cea25514e1fb4e750b136fcf3ff979bca5a950d9c5e1519591787732380bb2","ssdeep":"6144:+ZmgvFsUIY0mRrSWAept/X8Xt6kXTfyGmlvWyHjmhu9kO0n6FUwumFbMSAwLc/d:4qUD0JPvgJmhulEoMSlLc/d","tlshash":"8e65c56c97a193fc5d6ac3e18e2040b47d8f96ee7650a33cd279c670b1625ecc5c8c9a","size":1464905,"data":"","first_seen":"2023-03-07T13:17:59Z","last_seen":"2026-08-11T14:39:52.087305Z","times_seen":617,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-13T18:52:18.017366Z","times_seen":266701,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"cabc5d07dec4c381f521bbcd41c009db","sha1":"ca329d086682a4d75b5528d326a66a6d3fffab13","sha256":"2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9","sha512":"66f6e36c99f2b57f526b4dff01c6cffe787d2bde6d6abe11d080314d2da08760a18889de7ebd6bec4a675429694d650437b55aaef12c1f7aaebe463587474016","ssdeep":"768:+hkw5E0MWirtTVU4t8GMqm7MT8VbdPyqzgqqqLWpeki3iMFpnkIID0Jhp6zvsv1z:+Z2TTktMqTiaDkIxIzcn","tlshash":"ef538249b254787206df747a817b460bb73a2899a046813cb97ad8dd1f7cc893173fb8","size":62411,"data":"","first_seen":"2023-03-07T01:02:38Z","last_seen":"2026-08-11T09:08:04.259045Z","times_seen":2538,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T14:25:52.129Z","timestamp":1785853552129,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/ HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nx-powered-by: PHP/7.4.33\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding,User-Agent\r\nset-cookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8; path=/\r\ncontent-type: text/html; charset=UTF-8\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}],"data":{"size":2594,"size_decoded":1320,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c9dde231923deeadbc8f199f89fdc793","sha1":"50f168cbe1f1a37a5cf2a10b8ed06fa80924fa19","sha256":"ac353dd716195dda451ec6d9ddb35cd99a7b81b872988e5cc88d219fd56551ce","sha512":"b04c65574fd8183fbed355f04c18a9aebcbeb02cd8f043150a3c19b2e260c72dabc65f2f6dfab896a3b1d2129a39445604de8db7529a8b62d747843e7a541408","ssdeep":"","tlshash":"f2511034dcf4842b615144b43e72ac8f5ee2e60bd65e9a8570ec96901fc2f8acca758c","first_seen":"2024-08-19T22:59:50Z","last_seen":"2026-08-05T04:15:31.419662Z","times_seen":23,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/css/bootstrap.css","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.364Z","timestamp":1785853552364,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/css/bootstrap.css HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Mon, 07 Dec 2020 23:50:12 GMT\r\netag: \"2f1f7-5b5e87ca85500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 24828\r\ncontent-type: text/css\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":193015,"size_decoded":25123,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (560)","md5":"052dfc723bbdf659b1528e37b1472301","sha1":"a06f1b5340a4dceaa9a8e044d0248ab48fcb7e17","sha256":"0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334","sha512":"99a22fd4a93d74eca1883c15ee63799eee662428db0371a26003d14988c9bf8300597835b38637aa2c5961e9dde3b8e67eb371609e2e68e62ddaa62bdd792a97","ssdeep":"1536:Hgwcfq/zc1+QI/Rhi4De5j9p7AC2LdQVUaryWrSPUKO5kIl8d/ALfLNLy:Hpc178d/ALfLNLy","tlshash":"10140f9dfdf118087057956864dbbbf57b7e4086d20ece7a76e23264cf493c18c62a88","first_seen":"2023-04-05T04:36:20Z","last_seen":"2026-08-11T09:08:04.231392Z","times_seen":1248,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWHBXyXfDDVXbF6iGmd8WA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.752Z","timestamp":1785853552752,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/mukta/v17/iJWHBXyXfDDVXbF6iGmd8WA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://nieuwestep.nl\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 21604\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Jul 2026 13:14:47 GMT\r\nexpires: Thu, 29 Jul 2027 13:14:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 522665\r\nlast-modified: Mon, 08 Sep 2025 18:06:38 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":21604,"size_decoded":22417,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21604, version 1.0","md5":"a4069cc515298ca7af2e063e345637d9","sha1":"b018c88e2e32e61c76015e56b268ddac3fc710a7","sha256":"1907b5bc922c15f4eb0543ea00704cb366745b913656dd3264d5e6db03e1e276","sha512":"c075cc1cd21187b6a1f13c9c73609c04df2c397573f3f96e0a11e9696c89366330de4b4a48e2fcab3cc08733b0a43a19d6560172aa4c3111bbc800741f234ec5","ssdeep":"384:uc1/VSJcD+oGqKL0rN8bwgBZh9ffkeBtapFpQzbxh1rLl+7MoNUOiC23QsP0/Zzt:uA/XtGJ0c/h9EYsQzNjrLl+Xd72A/Zzt","tlshash":"51a2d04f89d3666dda70273a108d0c79adc830c3b5158a5643261f450edfab7c4dbda6","first_seen":"2024-11-12T22:29:28.721882Z","last_seen":"2026-08-13T03:53:29.679602Z","times_seen":1019,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":28,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/image/logo.svg","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.821Z","timestamp":1785853552821,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/logo.svg HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Wed, 21 Feb 2024 00:10:16 GMT\r\netag: \"1813-611d926c0aa00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 2584\r\ncontent-type: image/svg+xml\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6163,"size_decoded":2882,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"38be0de766af1aaa475f946c32b47944","sha1":"646ff2fae3c8080da7c067e6506f1a1193b9cfc8","sha256":"330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4","sha512":"20feebf7e0888ac048f0fbcd8c09c748df432ed946460c886dcdf89b49da98cc9a2af35116b3b28a0f30a1c0d3cae36856d2719dca35f97693aa2fa310c56bb2","ssdeep":"192:9D/pNzACPyEwZ+p5M3TFITYJxSWRRZblnPpl8FL:RpNzACPpK+v+OYJxSWRbblnPpGFL","tlshash":"e0d14fc7a314d3ade9c5d21def62d854a20f60fbf4a6c6c1999fcf4c5487882fa09a50","first_seen":"2023-05-10T17:52:44Z","last_seen":"2026-08-05T04:15:31.414422Z","times_seen":252,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/respond.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.549Z","timestamp":1785853552549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/respond.min.js HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Fri, 27 Jan 2017 14:50:20 GMT\r\netag: \"11f1-5471495b2e300-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 2218\r\ncontent-type: application/javascript\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4593,"size_decoded":2525,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4453)","md5":"78915bb8b3dd6696d3842d82ed48b104","sha1":"504cce482567765d63843d7b9d00c4195109c449","sha256":"1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e","sha512":"fae71ebe045ce6a2c190b47bda2a0dd9f042c659c8225f566a31ddf1872de61048b99efcb9d9dfb02860e5304940b30c1dfcfdc00c96424f6e97374738139fcf","ssdeep":"96:fmeKAql8GALKZ2sdX0MVrpezoG3+gTYkhs7/tQMBze2EOgSUHB75h0:fnqSGTZbvVrpezoVgdSjtQMle2EOgSIc","tlshash":"a891c8a422203548e2ea3825967f4226f8739cb575584890d515e8b83da8fed10f7ff7","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-11T09:08:04.249231Z","times_seen":468,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.551Z","timestamp":1785853552551,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.0.0/js/all.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 447131\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 07 Feb 2022 21:01:39 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L0UFBYfR16bjZdZSZGPzLJ7Ry0%2F27WHRqQvaxwE5DMQvGFqtyXg7S3J5u6XcrHUhv%2F0ewM6PcQ2koplX1GWHYXNuYZVtto8Il8GFONTMgqsJf4bo9yYHV0AuLyW4FQpjb6JKo7kC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a25e3bdf8a490afa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1464905,"size_decoded":448135,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65317)","md5":"cc00e694fc491cf03655f43eb83ab9bd","sha1":"5b3b17c5b355f473ab89b42545410c51ad51bf58","sha256":"f8a3bacb8d21a5c19437a8b1573b59e6c1850bf37efd0d1a13418d41f917ff3d","sha512":"fa590d5a18270ca6760b74b418a9ccb7d7ff76e3271c202d9fd564bd6985c77b6e9c5d95164824e04a339597b5e84deb3906fdbc5f7d7fcb7bfeaa48eab6e6b4","ssdeep":"6144:+ZmgvFsUIY0mRrSWAept/X8Xt6kXTfyGmlvWyHs:4qUD0JPvgG","tlshash":"d425a46cd7a093fc5d6a83f58e2040b47d8f55ee7690a33cd2a9c670b1624ecd5c8c9a","first_seen":"2025-07-31T22:20:51.99194Z","last_seen":"2026-08-12T15:10:12.780676Z","times_seen":461,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":3,"connect":14,"send":0,"wait":67,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.556Z","timestamp":1785853552556,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Tue, 24 Mar 2020 22:30:48 GMT\r\netag: \"5a88-5a1a14da4b600-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 5877\r\ncontent-type: application/javascript\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":23176,"size_decoded":6184,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-13T16:46:01.416898Z","times_seen":4234,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/image/re.png","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.570Z","timestamp":1785853552570,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/re.png HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Wed, 21 Feb 2024 00:15:38 GMT\r\netag: \"11a9-611d939f1fe80\"\r\naccept-ranges: bytes\r\ncontent-length: 4521\r\ncontent-type: image/png\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4521,"size_decoded":4752,"mime_type":"image/png","magic":"PNG image data, 277 x 67, 8-bit/color RGBA, non-interlaced","md5":"020fc8f7ba7a2303202b1ad697f8d5c2","sha1":"8d67bafe11f462c77b79cf2f143b79bca2b3bb17","sha256":"c93e75c73d7e0ec67c15f7a18db4a0b0bcb3d22f625f542bb5b16775401c5145","sha512":"65e924c52bb1f737a768f9f0b84699be3884cd133503419698f2413124a1deee17bd82059b4a49d5e09731b50319ad9d09d3cd5f093eb50fc753cbe082f10f32","ssdeep":"96:oD91rj8CPpRG0dGXwEzBaM1NErX3KXEcuuTMooTgeZof30+:oDrNhY0EAABaMzErq0ygovffd","tlshash":"0e918daf13335bc68d0392234cd19423bd28e327e5486d15977f5b6a8228fa1ea35b40","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-05T04:15:31.42233Z","times_seen":44,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T14:25:51.999Z","timestamp":1785853551999,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlocation: http://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\ncontent-length: 262\r\ncontent-type: text/html; charset=iso-8859-1\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T18:51:39.072062Z","times_seen":17874979,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":7,"connect":29,"send":0,"wait":33,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.554Z","timestamp":1785853552554,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Mon, 07 Dec 2020 23:50:12 GMT\r\netag: \"f3cb-5b5e87ca85500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 16021\r\ncontent-type: application/javascript\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":62411,"size_decoded":16329,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (62126)","md5":"cabc5d07dec4c381f521bbcd41c009db","sha1":"ca329d086682a4d75b5528d326a66a6d3fffab13","sha256":"2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9","sha512":"66f6e36c99f2b57f526b4dff01c6cffe787d2bde6d6abe11d080314d2da08760a18889de7ebd6bec4a675429694d650437b55aaef12c1f7aaebe463587474016","ssdeep":"768:+hkw5E0MWirtTVU4t8GMqm7MT8VbdPyqzgqqqLWpeki3iMFpnkIID0Jhp6zvsv1z:+Z2TTktMqTiaDkIxIzcn","tlshash":"ef538249b254787206df747a817b460bb73a2899a046813cb97ad8dd1f7cc893173fb8","first_seen":"2023-03-07T01:02:38Z","last_seen":"2026-08-11T09:08:04.259045Z","times_seen":2538,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/image/logo.svg","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.567Z","timestamp":1785853552567,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/logo.svg HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Wed, 21 Feb 2024 00:10:16 GMT\r\netag: \"1813-611d926c0aa00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 2584\r\ncontent-type: image/svg+xml\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6163,"size_decoded":2882,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"38be0de766af1aaa475f946c32b47944","sha1":"646ff2fae3c8080da7c067e6506f1a1193b9cfc8","sha256":"330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4","sha512":"20feebf7e0888ac048f0fbcd8c09c748df432ed946460c886dcdf89b49da98cc9a2af35116b3b28a0f30a1c0d3cae36856d2719dca35f97693aa2fa310c56bb2","ssdeep":"192:9D/pNzACPyEwZ+p5M3TFITYJxSWRRZblnPpl8FL:RpNzACPpK+v+OYJxSWRbblnPpGFL","tlshash":"e0d14fc7a314d3ade9c5d21def62d854a20f60fbf4a6c6c1999fcf4c5487882fa09a50","first_seen":"2023-05-10T17:52:44Z","last_seen":"2026-08-05T04:15:31.414422Z","times_seen":252,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/image/lg_ft.png","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.571Z","timestamp":1785853552571,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/lg_ft.png HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Tue, 25 Oct 2022 08:30:56 GMT\r\netag: \"828-5ebd7ba153000\"\r\naccept-ranges: bytes\r\ncontent-length: 2088\r\ncontent-type: image/png\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2088,"size_decoded":2318,"mime_type":"image/png","magic":"PNG image data, 36 x 54, 8-bit/color RGBA, non-interlaced","md5":"9babe7d8ee8b71fa4e2d182a9e00ecad","sha1":"65611d3262c80efd253dc48c1cc02b2972cbbce3","sha256":"5922e6cdf9697c4715890db143a911157ec694af68dd2b63a9b72a25dc498f91","sha512":"35124cf5b61eb79b6e8476bcd12520d4dbd424c8b9006dd7eb0deae64f91adce3834ae27203a109cbc1665ab57005119d1bc9a15c76dffb0508c2061dbdeccf3","ssdeep":"","tlshash":"6a411896562041b0c85a8d2728e1a114a2821c1e9720dcfa893d8cdbede786ab56b11a","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-05T04:15:31.423235Z","times_seen":42,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Mukta:wght@200;300;400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.581Z","timestamp":1785853552581,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Mukta:wght@200;300;400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 04 Aug 2026 14:25:52 GMT\r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8262,"size_decoded":1288,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9bb1f420562d6273f53c110b466f2ccb","sha1":"06e072ad03707b118b11ac0071fbca741293aa1c","sha256":"8c61a48dd337fa2b8f7b06be0e30de0da26c4932fcd191b4836cab0e35c18212","sha512":"45f083ec67e5f3996d69d9caaa13d67f7724049fac517bdde8ca3d5c31a718d5865fc1ea84d3e949743379cdd5c2865af7555a388615f94beb7a1cca961ac419","ssdeep":"96:DO6aSO6aJJc+uVO6asNmO1aIO1avJc+uVO1aaNmOEagOEaZJc+uVOEamNmOXaGOc:6/pDhur82vZRpiFiiU+/e9U4tm6tO","tlshash":"6102fd9004a7a400ff972cc122cebe22de5e72546054d5b9affe18c8addfc2a1391b5d","first_seen":"2025-09-18T00:06:54.432203Z","last_seen":"2026-08-07T10:28:54.032876Z","times_seen":199,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":35,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWKBXyXfDDVXbnBrXw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.729Z","timestamp":1785853552729,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/mukta/v17/iJWKBXyXfDDVXbnBrXw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://nieuwestep.nl\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20480\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Jul 2026 13:11:21 GMT\r\nexpires: Thu, 29 Jul 2027 13:11:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 522871\r\nlast-modified: Mon, 08 Sep 2025 18:10:40 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20480,"size_decoded":21293,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20480, version 1.0","md5":"5fd54c8638ba894fdcdb77dc6ac4a243","sha1":"bef5c820b46979a18ba459f94ac6ac4bc782b910","sha256":"510168c767781af2e91c8c62b29baef5673b3b00445e9ab97fc2d0cdc99fd8c3","sha512":"7ec7da9fcb2496550d2c9d3331ae3d8dc20482370ed3c6478112c058341de0a3a954058c7c8f56acbb9b4e166fb7fd1992c928eba54ba5ed58e7e6819b9c4b74","ssdeep":"384:0kp8SJ6QoC7m1Lu6nDTJbUMW9Oohs/GbLAdtPUiMgGELyn5dQi:uScQbifvJboOIcnUhgnU5Oi","tlshash":"4392e0fa76a016c4e0cc1bf9d061d5b5d4a8dea4d3102d4c23a4ce3d9e45fe6707798a","first_seen":"2024-11-10T07:53:47.902253Z","last_seen":"2026-08-13T03:53:29.682318Z","times_seen":1245,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":3,"connect":29,"send":0,"wait":22,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWHBXyXfDDVXbFqj2md8WA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.754Z","timestamp":1785853552754,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/mukta/v17/iJWHBXyXfDDVXbFqj2md8WA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://nieuwestep.nl\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 21164\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Jul 2026 07:48:51 GMT\r\nexpires: Fri, 30 Jul 2027 07:48:51 GMT\r\ncache-control: public, max-age=31536000\r\nage: 455821\r\nlast-modified: Mon, 08 Sep 2025 18:06:19 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":21164,"size_decoded":21977,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21164, version 1.0","md5":"b4c317e3a2107dd8a7bfe722ed2b0d03","sha1":"fa474b4832c6505cebe6152a4d9becb272bb828e","sha256":"e304e9c80a75b34cfe0180c83ce8f401cc61c570078c726af863f19bb1f2f4e3","sha512":"0695af22fbea402e2812ff668cff5f86bd93111b955263967b32c72d4ae2ecdf9cc8f3e4704ed94eff4071a4935926ac20a2561f55150b47bed8566a005450ed","ssdeep":"384:IPNpOAlGoA2PSzWwPJHJubXULzU7i6Rcg0fHB/p5qkUdSGOmwJbybL55BFTx8zky:IP3OA0n2PJwPJHJPE7iLfHVjmww1lNmp","tlshash":"8292d00f2e45971dfa0a5a7cf09f708a0c20d619ed64665bbdeb6114624abbfbc1c702","first_seen":"2024-11-12T22:29:28.713783Z","last_seen":"2026-08-11T19:38:16.489977Z","times_seen":383,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":17,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/css/test.css","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.366Z","timestamp":1785853552366,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/css/test.css HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Wed, 21 Feb 2024 10:25:02 GMT\r\netag: \"91d-611e1bd545b80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 826\r\ncontent-type: text/css\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2333,"size_decoded":1117,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"03a9ce69d9097a324d433d1f0ddc3d3a","sha1":"6f6bdc173e191082f54464ce5740819aa8e262ab","sha256":"4769dde8f80f8cea0296811653226b72c46c7a0fa8cf744fbd981e0fa531e2de","sha512":"1319274b81c5dfc2f8a1281dfd1b4ca37af72d071298a9159f967e44714379170c5aa9d08e4553483855100541cc806585b05a85a1a2255327378dec9acea71e","ssdeep":"","tlshash":"a241d0eedd1810087273dd98b3a25e9aab5e0096db074a79bff02054f14661d5270fcc","first_seen":"2024-08-19T22:59:50Z","last_seen":"2026-08-05T04:15:31.415317Z","times_seen":26,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.547Z","timestamp":1785853552547,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Tue, 22 Aug 2017 05:37:38 GMT\r\netag: \"aaa-55750fe3d8c80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 1348\r\ncontent-type: application/javascript\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2730,"size_decoded":1654,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2639)","md5":"40bd440d29b3a9371b0c63fec41ee64f","sha1":"e790c26449c57de298923c686cb3434d1d461a1d","sha256":"dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48","sha512":"50326d2577f37ec88f3e09c8e52d74d3414f2c11cc86fcc0317d7923ea86d84d8e0330bd3f527353024e7e7ca95e2387ecc44f6aace13db0460cd363ef305fa0","ssdeep":"","tlshash":"4751a8857062714a8b2f11ab917f970ff5e452a6d8580060d0e9c87cf930df8c2bbf65","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-13T10:31:01.634682Z","times_seen":1833,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.553Z","timestamp":1785853552553,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Tue, 24 Nov 2020 08:18:26 GMT\r\netag: \"15d84-5b4d5f4769880-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\ncontent-length: 30910\r\ncontent-type: application/javascript\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":89476,"size_decoded":31219,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-13T18:52:18.017366Z","times_seen":266701,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/image/le.png","fqdn":"nieuwestep.nl","domain":"nieuwestep.nl","tld":"nl"},"ip":{"addr":"185.104.29.124","port":443,"asn":206281,"as":"Stichting DIGI NL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-04T14:25:52.566Z","timestamp":1785853552566,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nieuwestep.nl","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 17:31:57 GMT","end":"Fri, 25 Sep 2026 17:31:56 GMT"},"fingerprint":{"sha1":"1A:6E:68:9C:70:DB:66:EB:AA:DD:58:46:BD:09:51:9C:E9:B4:28:9E","sha256":"BB:B3:ED:74:12:AD:BC:AB:28:5A:CC:70:56:6C:C6:C1:B1:18:DB:BC:6E:35:15:B0:B6:8D:A1:6F:FD:70:8F:78"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/le.png HTTP/1.1\r\nHost: nieuwestep.nl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://nieuwestep.nl/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=496f7f97ba730de4754a6389e8f673d8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:25:52 GMT\r\nlast-modified: Wed, 21 Feb 2024 01:03:04 GMT\r\netag: \"182b6-611d9e3948200\"\r\naccept-ranges: bytes\r\ncontent-length: 98998\r\ncontent-type: image/png\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":98998,"size_decoded":99231,"mime_type":"image/png","magic":"PNG image data, 485 x 618, 8-bit/color RGBA, non-interlaced","md5":"e4d42741c0b226ade31ee8e351614256","sha1":"9a101852d626d820ee2211f3458681510d6ce74f","sha256":"5bf09d7de18b50a0f421b919a5934b532ef1b46b82801294fd6a1b8e1cc5aba5","sha512":"0f4afc961b280682046e41b0f26deef2d35922ea1f0fca0154ebb2b69f41014d417c7b0d3958e9e29dff01c7942fc8cecc73b01e413613c70b82bac69a20f806","ssdeep":"1536:W/uuu5t80GjYKcjbupGRjvnF4JK4jApocPeId6FYdQfFm2Zrf6ur/xUQKsJkJSY9:PuIcjYh+pg/aJ/Apo26FvFlYsJl3+F","tlshash":"86a312a752e4d3d8e118aac3c70a8e0ace0d5968b31ae71efcc6f537530e5d448a52d3","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-05T04:15:31.41158Z","times_seen":43,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"nieuwestep.nl","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}}]}