{"report_id":"6fa5c63d-d4b9-458c-aef8-cb2222cdefdc","version":0,"status":"done","tags":["wetransfer","phishing","financial"],"date":"2026-08-13T18:16:40Z","url":{"schema":"http","addr":"almistranaya.com/","fqdn":"almistranaya.com","domain":"almistranaya.com","tld":"com"},"ip":{"addr":"104.21.2.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"title":"WeTransfer","dom":{"size":20892,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17436)","md5":"d4361bcaa26d82184bc159b00f184053","sha1":"fbc6ca7a4b7fa3000591236e916124fdc8cc8231","sha256":"3305ee0229ed98d71c5258eb8120696143054ae3782d3aa9de79e750da21e5ca","sha512":"974b3a421d555a5662d4bd69b30525024700a33ea8b41864c988881fea3ed2004168212e6e4349e40e2743f89545469e9b2688156044d9a6933d8aa2f4ab0bb0","ssdeep":"384:B7MCMpFMCMpBMCMpuMCMpgMCMpZMCMpLMCMpANspuoamIQG58oL:FMCMPMCMfMCM8MCMGMCM/MCMtMCMAspg","tlshash":"7692d0db559262698d135e6343cc191c99389ea34a125d9eb22e140dafc7ff823d333b","dom_hash":"domhash33bfc305e11606005c6639c4d96223b3","first_seen":"2026-08-13T18:16:44.092895Z","last_seen":"2026-08-13T18:16:44.092895Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"almistranaya.com/","fqdn":"almistranaya.com","domain":"almistranaya.com","tld":"com"},"ip":{"addr":"104.21.2.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-17T18:16:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":7}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"almistranaya.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-09T22:20:44.514027Z","alert_count":0,"request_count":4,"received_data":175792,"sent_data":2304,"comment":"","tags":null,"fingerprints":null},{"fqdn":"online-zahlung-info.de","ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-29T08:08:00.404956Z","last_seen":"2026-08-13T09:22:56.590826Z","alert_count":88,"request_count":22,"received_data":106354,"sent_data":12707,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap:5.0.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.17.207.5","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-08-09T23:02:50.69879Z","alert_count":0,"request_count":2,"received_data":236853,"sent_data":1034,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-09T22:45:53.985835Z","alert_count":0,"request_count":2,"received_data":1538683,"sent_data":1006,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-09T22:23:43.881052Z","alert_count":0,"request_count":2,"received_data":69979,"sent_data":1120,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.129.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-08-10T00:14:04.793702Z","alert_count":0,"request_count":1,"received_data":90305,"sent_data":472,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"almistranaya.com","ip":{"addr":"104.21.2.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-10","domain_rank":0,"first_seen":"2026-08-13T09:22:29.915306Z","last_seen":"2026-08-13T09:22:29.915306Z","alert_count":8,"request_count":2,"received_data":1569,"sent_data":993,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.129.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89664,"data":"","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-13T18:16:44.105576Z","times_seen":34279,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.17.207.5","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0aa8d64e726c4a57adb5c88f9115996b","sha1":"901169527507ff9e662cf64d8e361f359308970d","sha256":"7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe","sha512":"ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCs:MFRIpk0vSAV","tlshash":"a573d6493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","size":78743,"data":"","first_seen":"2023-03-07T01:03:37Z","last_seen":"2026-08-13T20:06:54.159746Z","times_seen":24494,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5beb8fa265f90be5ccadd6b32b8672f","sha1":"7bdc23c06b51e7e42c05de486680a3c18aa5ce5a","sha256":"6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e","sha512":"9daba447b23e364ea0a7ba794cc038c9c81fc5a64127b30ee620b7169eb2490c8a1473867e9912664615595e51eeeedc7c089cc5a9f0610e43d5ed7b11f25c30","ssdeep":"6144:JTrRrD1LXomaR3Ls8FBHHcKqgyjjGpGxcrK69aRYRMtsDo6ug+1MdZvdj/drgVFT:JCsqHSgyfB69ARYXDooYMdjdW/7jr","tlshash":"8065842cd365a3bc9da6c7f5ca2130b46d8f51ee71e09328a278c5b072621dcd5d9cca","size":1528342,"data":"","first_seen":"2023-03-09T05:04:22Z","last_seen":"2026-08-13T18:49:31.430597Z","times_seen":5813,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc290e6c3aeecf5021dd82ad8df2512a","sha1":"fb983aecd3940e8ebbfe5e74c8099cee9223c957","sha256":"2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995","sha512":"a47546a57ec5ff6ef267421263e5558f250b0296c3943d3f5f4ae019b4ea084ed6156e4c7b3353586fdd9e1b5b06e202cec7745903e0a44e111012eff94a8287","ssdeep":"192:cd227YJcI/iarixR4aCSfZrkiqVNReFevZA8A/A:cdaJ39e74boZrkVVjeFexA8AY","tlshash":"b502e8d5329670b253b371e901bf020bebb7afa156de4814d61a94e0ae74f890053f7e","size":8327,"data":"","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-08-13T18:49:31.421964Z","times_seen":12955,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/js/js.js","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bd6047714ad98380627de6660942f6cb","sha1":"42f139b3c0300aa61a628fefd7bd0c840b441a83","sha256":"66e18c545137f9f9f53f7aafdeef741e942115e64028893ddeea47f043059fdc","sha512":"e0e35879b1200edc66ef7e72a8dd014fe08ca74dd550407a5ea1f14b83f3932972ef8a546533a0cc752d2912f6f9ed11c95597c38d6f999833728ae81ae081ce","ssdeep":"","tlshash":"5721a128b930a8e150b7727f2d76dd04ea2d78af58096210b51d6c5cefbd248971291f","size":1128,"data":"","first_seen":"2026-07-29T08:08:04.754523Z","last_seen":"2026-08-13T18:16:44.115715Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"almistranaya.com/","fqdn":"almistranaya.com","domain":"almistranaya.com","tld":"com"},"ip":{"addr":"104.21.2.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"01ccb7c1cd5eb08e9bf5c09cc2d8e5c4","sha1":"6fd631dd336fdc502fe5eb9f2643791a4559a77f","sha256":"c630a3ac6ea127acafa2e161f2e4f837d4eb7670bb534324c048ea6e75a78ac7","sha512":"4e3a03648f2559e405fe7acc6eb18670b7a1a31c3c3c739f785490f1491e277ceb3124dadfc23d5e71ba241190482d6e04cd4b0276500f8d04fd141a41587435","ssdeep":"","tlshash":"8df00cde29e2105ad2e5a9569b57f2b09030f4470fe2c849370cdf70af2481ef06b6da","size":640,"data":"","first_seen":"2026-07-29T08:08:04.766001Z","last_seen":"2026-08-13T18:16:44.118093Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.512Z","timestamp":1786644973512,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:39 GMT","end":"Mon, 12 Oct 2026 18:07:38 GMT"},"fingerprint":{"sha1":"12:E8:CE:14:FC:4E:1E:0D:A3:9B:2E:5D:D0:88:79:79:71:C9:F8:6A","sha256":"58:07:B9:A1:6C:54:97:F9:9D:6A:66:E2:49:57:FB:86:86:8D:12:97:8F:4A:C9:74:A1:9D:69:4E:1F:A6:CC:9D"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://online-zahlung-info.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 13 Aug 2026 10:17:38 GMT\r\nexpires: Fri, 13 Aug 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 28715\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43948,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-13T21:52:08.733406Z","times_seen":261427,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":0,"dns":2,"connect":30,"send":0,"wait":17,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/imgs/ff.ico","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.663Z","timestamp":1786644973663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/imgs/ff.ico HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sun, 16 Feb 2025 04:56:33 GMT\r\netag: \"6e63-62e3b3b4b4240-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/x-icon\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vX6omvSSsEN3bZW%2BOATKgguItnQ96M%2FIwy25G2Pesl47FIH%2B1v8S2CPRSQlZgoimzXfqwIPeB6ypZnXLZvOOSK%2Blzeugd0rw%2B0QAw7pRgLiKvYIDoE65bCM2%2BCQawszEBDbb0iBnXbyT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: a2a9b5ad6d2232fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13480\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28259,"size_decoded":14253,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 48x48, 32 bits/pixel","md5":"0645e49b155ab444261fc713aa430a85","sha1":"93780b55c5e1da673180ccf01f9b37ad624ae58d","sha256":"5981f65aeddede91c5d9900f524c1403334c0ec539dfd643f4ec14bf8bed403d","sha512":"b18bdf360d1bfa66329bc1b789d6da111d11c4ae337f555f1598d8ddf8867e62ac41dfe2342784ecf7a04ea90c39290a45e44bc7f46bb6d41bb5c5c4fee80e93","ssdeep":"192:gRgbUBYJhni13k4CF/uLI9AyYswG3HaGhaCUTepZC4qQVZGkSoa2j:iiUKJFi1U4CFGLTsLhF44qQVDSoa2","tlshash":"87c20740184f6812c098423679d0c93b9593edc770dafcef21ec5d23bf86a44b5a9eb4","first_seen":"2023-10-05T17:10:14Z","last_seen":"2026-08-13T18:16:44.097876Z","times_seen":50,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:32.097Z","timestamp":1786644992097,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:32 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pM4m6j8A8lD4wQh9fFQ1uQZRpfq%2F6p8914U6yaXfM%2FDgSZDJz68IP3ZfIe92ITrRX0k1uNlb4mpj7lNR6FVpjqyKRinApS%2F0aLUz%2B1tj%2BqpoCTjzNekrq7J%2FU0qGUsicB47%2BlLBinZHl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b6209e5e32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.17.207.5","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.132Z","timestamp":1786644973132,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 22 Apr 2026 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"65:D9:C4:7E:04:4C:FD:DD:60:E0:CC:18:B5:B7:01:68:B4:2D:C7:34","sha256":"50:6C:A4:F6:ED:74:C7:E9:68:DB:32:56:5A:68:4C:98:ED:01:28:36:F8:13:BA:CC:19:A7:FD:7A:0A:6E:E7:D4"}}},"request":{"raw":"GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 24303\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.0.2\r\nx-jsd-version-type: version\r\netag: W/\"260c5-fByeBXPlzqi603M74vxjqoxo6o0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-eddf8230108-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nage: 810222\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=edGVU9iLWU%2BLMMj5PHZCJcitX%2BGlea580ojUKe7R%2Bc6YnAImoJNGP56%2B3ix7%2B7ah4jrRx9HT%2BJKGpP2TJqaKb2awO8tddR8Mp%2BbUqoG%2BEJ%2FJ54UTw0I%2FsUVfnkeBccLGfrU%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: a2a9b5aa3bde0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155845,"size_decoded":25418,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65306)","md5":"abe91756d18b7cd60871a2f47c1e8192","sha1":"7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d","sha256":"7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b","sha512":"bac54101debafcda5535f0607b5f60c2cda3e896629e771ad76ac07b697e77e4242d4f5f886d363b55fc43a85ea48a6bfc460a66f2b1fc8f56b27ba326e3a604","ssdeep":"1536:d0bwW83RipVVsEBpy0cuJcf22RWb5CyVUpz600I4fM:d0bwlyVUpz600I4fM","tlshash":"09e3a3d7f581241dd4a7c259a0d1bffd052f4586e3025babb0277bb88b8a6c70963e4c","first_seen":"2023-04-05T03:16:49Z","last_seen":"2026-08-13T20:06:54.156568Z","times_seen":99153,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":8,"receive":1,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/css/style.css","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.136Z","timestamp":1786644973136,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/css/style.css HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 18 Jun 2025 01:14:15 GMT\r\netag: \"1134-637ce58ed47c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D8msVVckPz8ZLFgRRJAN9iSFUCOrLp6x7utRswR0qBkvlFXfLGVFTK%2FKnF%2BA1Me9%2Bk3DBAxj%2FrxavtRhIa9p07rPfWlRiyKvUGIe1gnYNIGFUT1BwYSn8V5b30jh9dM7XZXjAt1bnNXg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a2a9b5aa1c7b32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4404,"size_decoded":2188,"mime_type":"text/css","magic":"ASCII text, with very long lines (4402), with CRLF line terminators","md5":"cdf749bf5cff85fb77d2ce83bc779318","sha1":"29ccc7dc6aa691de30924583cd8a2fdd491ff8d1","sha256":"fda156808a410f6de9163f186f9613f43d71ef9c67dd72418da37dc720069bf5","sha512":"3ccdee2bd9f4fa0891f29ec5f26ffe1ff9f81dba5e8c403260a29caae86a969ef3e1b921595baee1792d0735a5d43a1c897615dccb68f713a88334f1b8df75a3","ssdeep":"96:6rjeAriSFc77ythUFExBxFexnxPxCx+2UxZXxQ9xMcNFxjWPRK0/umE7ah77AoK2:YeAriSFc77ythUKH3e9RU42ULy91/ZWN","tlshash":"ac91113154993428f51bd57e70d09a99b1388032d3bba2abd9dab12ac7c61e7933730c","first_seen":"2026-07-29T08:08:04.757153Z","last_seen":"2026-08-13T18:16:44.101785Z","times_seen":11,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.535Z","timestamp":1786644973535,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:39 GMT","end":"Mon, 12 Oct 2026 18:07:38 GMT"},"fingerprint":{"sha1":"12:E8:CE:14:FC:4E:1E:0D:A3:9B:2E:5D:D0:88:79:79:71:C9:F8:6A","sha256":"58:07:B9:A1:6C:54:97:F9:9D:6A:66:E2:49:57:FB:86:86:8D:12:97:8F:4A:C9:74:A1:9D:69:4E:1F:A6:CC:9D"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://online-zahlung-info.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 13 Aug 2026 10:17:38 GMT\r\nexpires: Fri, 13 Aug 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 28715\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43948,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-13T21:52:08.733406Z","times_seen":261427,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":19,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:19.776Z","timestamp":1786644979776,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0dbQShoh0V32uDS8SOp1Zq0Thtd4S2%2FiXJeYCHNFPHDxz88vKHRC%2BgX9T%2BRZ3Rt8Gh%2BFLUYlUfeHu2%2Fhtck9VjLDHAoWG0rGPtOt6OFuzR5rZWE3GvmEpfzT6aBkUPney0FqWO4yge6o\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:19 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2a9b5d39d3732fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":686,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:23.887Z","timestamp":1786644983887,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:23 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iq%2FmWfcPTorlqc%2FYucwdH4hBtb2kZvIt%2FhQvzUplSHZgkpIlQ8ZyLExc9wOFo4N0R2Z0Qhw8XOm%2BOvD%2B%2BibkbCSXr6k03EGmC5LN4xoK7sSBUjPuD3XA51GAoXZgK%2F71ixAgGGcn%2BGUM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5ed4b1932fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":692,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?redirection=loginfile","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T18:16:12.744Z","timestamp":1786644972744,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?redirection=loginfile HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://almistranaya.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nlocation: y4PIhBPQfUduDWyLtuqwcov0?\r\npriority: u=0,i\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:12 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MOocxU1CFbdSSSMpj3xGZUDfb0PuMzHzrcwPL0D0KA9qsdE88cRO2Tj9y9QhG9dBecnIqAIMtZg%2FupcpqwB%2BtXDLE0MadJ4VJqZrr7OO2olLTTL40aoLH7bxt5lH3g5IDJNau06C5d31\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5a7abec32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.146Z","timestamp":1786644973146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 3074\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:11:47 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mDLQIoUgWyCAyHAEbEodO35aMx63ckdjVDiPnEq%2Bw6bsne4yxpL5StNuZdpcwineN4Y8%2B6Pw5lF6pJboAsWFLM3EwEyjbiIzN%2FTq0BZXPF9voL9xvM9sqMiikpGnNB1krpTUgiu2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a2a9b5aa4e2b0b41-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8327,"size_decoded":4078,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (542)","md5":"cc290e6c3aeecf5021dd82ad8df2512a","sha1":"fb983aecd3940e8ebbfe5e74c8099cee9223c957","sha256":"2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995","sha512":"a47546a57ec5ff6ef267421263e5558f250b0296c3943d3f5f4ae019b4ea084ed6156e4c7b3353586fdd9e1b5b06e202cec7745903e0a44e111012eff94a8287","ssdeep":"192:cd227YJcI/iarixR4aCSfZrkiqVNReFevZA8A/A:cdaJ39e74boZrkVVjeFexA8AY","tlshash":"b502e8d5329670b253b371e901bf020bebb7afa156de4814d61a94e0ae74f890053f7e","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-08-13T18:49:31.421964Z","times_seen":12955,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.172Z","timestamp":1786644973172,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:43 GMT","end":"Mon, 12 Oct 2026 18:07:42 GMT"},"fingerprint":{"sha1":"3C:2E:4A:58:D0:DB:8D:00:50:7D:0E:E6:87:DE:CA:95:B3:BA:1B:89","sha256":"C2:4F:05:DF:4B:24:E4:A9:E4:2A:30:66:F4:78:E7:75:AC:AE:71:43:E7:DA:3E:24:4B:A3:AA:9A:39:4E:E2:E1"}}},"request":{"raw":"GET /css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 13 Aug 2026 18:16:13 GMT\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":67176,"size_decoded":3095,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"ab850d710cb8d2c822eca52fcb39630d","sha1":"6b1016a61cb54834b42380de194088a39d0673b5","sha256":"acbf6e2b73bf91ea123df383211a180d57eb23c883a466afdec45a80fd03587d","sha512":"75908bb4facb97dbdbb3df2cdd51b28165d7d9c0dbd60997f507c7e79d44709c97566f25b5249bae201225d5fb83877c43734052ebfe858a19edfd9ba4ef471f","ssdeep":"768:yDdD9DADNDgBDUKD7DnDWHncXgLUahdPuOJ+gaULUIIV1ClghUULPy7bYLgXU+l5:GyDSegtxyllff","tlshash":"6b630e91041b5440ab834ce223cebf35fe1f92507151d0b9abfc9b6baddbca6526835c","first_seen":"2026-02-19T23:42:18.856088Z","last_seen":"2026-08-13T19:22:31.143975Z","times_seen":10996,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":38,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:34.146Z","timestamp":1786644994146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:34 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MiY6YiOt9B06Jmy7THgcdozRXLk1OJsv3vDB2%2BFivR%2FnN4A24qXRP782Jknq9n%2FgXTk43JvQdKreE%2FvlhUt%2FZBRgAHODX0%2BusgpYFJiXL90zb8kvbseiAVx%2BjAApHiwChyiiFK90xprA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b62d68b432fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T18:16:12.578Z","timestamp":1786644972578,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/ HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://almistranaya.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf; path=/\r\nlocation: auth/z-index.php?redirection=loginfile\r\npriority: u=0,i\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:12 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oyHnYQgGE%2B%2Fqp3y%2FmM6vq6Vxc2NkW3FydZCCdT4dqcS1vSSJe62uMSCwlfYJau1HAoFq1uevFifM1NAbr2DwyYPH8f8KHt2L%2FsP6p5%2FGlwqwBh1OZ07nDX2UIQ85vr%2Bk5izZBZyvd33H\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5a6bbb032fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":7,"connect":15,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.129.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.140Z","timestamp":1786644973140,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.6.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15e40\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nage: 1673341\r\nx-served-by: cache-lga21975-LGA, cache-bma-essb1270036-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 42404, 27741\r\nx-timer: S1786644973.188488,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30957\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":89664,"size_decoded":31598,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-13T18:16:44.105576Z","times_seen":34279,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":4,"connect":9,"send":0,"wait":10,"receive":5,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.144Z","timestamp":1786644973144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 418541\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Tue, 30 Aug 2022 20:09:06 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IXBOUEOVmgY2ywXC8CwFB6yPD32SGGJg4IJ8cLisb8hbpMfGS%2FAnXmUfRXfv0UEOkjGA%2BRO2QgKF7qnln0yU4Kr7K7Pquh1Lturt%2FP5uyLOkT8f4Wkfn%2BsV%2FaGs9hsVTeoSDxI1u\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a2a9b5aa4e2a0b41-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1528342,"size_decoded":419551,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65317)","md5":"e930893a97a9ae1545bc1d4b7691ba57","sha1":"99c343b1d1c9331cd1a0778abfac9b7aeaffb108","sha256":"f648f1b49b22316288499e6f323156c4ccd9b0fd310bd58fddf482ec179d1016","sha512":"ef1e1641e478b378d6265daacddbdea5362221a45adbd6a993a1a416cba81740fc9de399f9bf1f45393657120f2a91a3f1710d13e7eb6589a0f178de3b187339","ssdeep":"6144:JTrRrD1LXomaR3Ls8FBHHcKqgyjjGpGxcrK69aRYRMtsDo6ug+H:JCsqHSgyfB69ARYXDooI","tlshash":"6425832cd36593bc9d9687f5ca2120b47d8f51ee75e0a328e278c5b0b2620dcd5d9cca","first_seen":"2025-07-26T17:28:19.15574Z","last_seen":"2026-08-13T18:49:31.429535Z","times_seen":976,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":2,"connect":15,"send":0,"wait":56,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:30.046Z","timestamp":1786644990046,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4xcAMErZXUX4fSRMHRLgtVrP6nlA0EHsFWKIrW2PxY6%2BeyErmxuCmcU0O8u94dFdW%2B7T8PD7b3XxeWY%2FlI9ikViFA%2BoLY0YZ6IQGmMW6wXnI0nUMa%2BpfQ9d4QPZn3o8MaV2aUnKYMG0Z\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:30 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2a9b613cba332fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":686,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/imgs/slogo.svg","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.153Z","timestamp":1786644973153,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/imgs/slogo.svg HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Thu, 03 Apr 2025 01:08:08 GMT\r\netag: \"436-631d5671cce00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A1B95kRb9z%2BrGE8sTGGi4eN5Fbmz08ZPUdjXN0KWTprpfTuhkppgqRvG%2B0f4pq7i9dJdTgaOv7XX0sFZ9DdVrTcCXK1kXRpmMgjN6Aj484RoqP3Zj3pn1RfdQeItI6VSoD52Aj5ckdyE\"}]}\r\ncf-ray: a2a9b5aa3c8532fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 604\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1078,"size_decoded":1364,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e9288611e5069e20d9571c2d7281c20d","sha1":"0d3f09f85d4f7704f3441008ead2bbdd42cb69ee","sha256":"e946ee16e66ad9b4708e31a2aac949197ace793f0446bafe3bd8f062d75ae181","sha512":"f0b0ffdf42bf3ef3a46e6babb9e537927a34b2869484b7e551e9722afcf36b5398e6b0ab51fcbc72f1b1115d9c9f2ee6503419d83a7bb9d11942fe754b8a6f25","ssdeep":"","tlshash":"1d1130fa1b789188458f8dbcff94bec5a12b94fa617808c0921a9f7cc803ac2b201954","first_seen":"2026-07-29T08:08:04.750326Z","last_seen":"2026-08-13T18:16:44.1083Z","times_seen":11,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:15.665Z","timestamp":1786644975665,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:15 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BOG0vKQKDAKXlwhvdo9c8CMCgDMfRhME78kLr3aX0nTqtnTLGJCUYbsJIK1q%2FtFhWxD%2B6Nr9LBHMOd1HQsHeyeauAWbo9hIrvqybGFFqJvoRR77zAKeyEpZQl9Eu%2FSMqHrWkeElkIP%2B5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5b9ef7632fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":684,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"almistranaya.com/favicon.ico","fqdn":"almistranaya.com","domain":"almistranaya.com","tld":"com"},"ip":{"addr":"104.21.2.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://almistranaya.com/","date":"2026-08-13T18:16:12.685Z","timestamp":1786644972685,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"almistranaya.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 16 Jul 2026 07:51:27 GMT","end":"Wed, 14 Oct 2026 08:50:10 GMT"},"fingerprint":{"sha1":"C1:02:DC:E3:68:61:C0:F8:19:5C:CD:6A:71:C5:7C:2D:1D:84:73:24","sha256":"96:42:CF:38:FC:9F:E3:B3:78:4D:1C:EE:99:F0:9B:04:76:19:24:8D:0A:2B:A6:94:37:B1:80:E2:32:C3:38:C4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: almistranaya.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://almistranaya.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cR1YpIuzu9JHQPV9HVW1eb7igSV7%2BaTiZ1viCLQqO86z7p%2FCCsiaN79a5Z0OnoeYH925s2ZCb%2Br%2BcNTtWqlrPdWO1oYlHcpewd4K3Bg94buKelc89J3kTsWa5a3%2BOZ7WlTvY\"}]}\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Thu, 13 Aug 2026 18:16:12 GMT\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=6,i=?0\r\ncf-ray: a2a9b5a74f66b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":303,"size_decoded":873,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"0555cbd01a255c51d746e82f49fa2944","sha1":"bf52243dd9f06a194d34ab2212d6a722935a33d1","sha256":"33694b3405d372f6d7919adb0319e63b324c6a624a94ab71a78b058596153f87","sha512":"edb8fea23c744fb93ae1c1cc92257c77e234bb96299fe7c625dc925596a5de9fa0320e47449134b13ee207044c93b23b2d3a4b51178e5fe88b54e7bd19a38305","ssdeep":"","tlshash":"47e07d9f405253860810bd5039c013c1624523eb28b4c2d86ec1c04351083bdc8a418d","first_seen":"2026-08-13T09:22:21.336876Z","last_seen":"2026-08-13T18:16:44.109192Z","times_seen":3,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"almistranaya.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/css/helpers.css","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.134Z","timestamp":1786644973134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/css/helpers.css HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Sun, 05 Jan 2025 17:36:20 GMT\r\netag: \"a3ab-62af8f327ed00-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/css\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fcR7tH1Cqyo17%2BZ9hNTSqFCjae7M8QP7CiaHffAV9USGqO6GbaNSCfPZeIVhDbSKYXsY1u1%2BKTjRYTJLbW9FUAKQlqafEsiJQlSMtpyjJN1Xoya%2FBR8f1o75rFRshgj7HI46D6R6JtxY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a2a9b5aa1c7932fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4814\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41899,"size_decoded":5576,"mime_type":"text/css","magic":"ASCII text, with very long lines (41897), with CRLF line terminators","md5":"726c60fc192383fbcf04e19677ad0959","sha1":"e2e966c2b6164806392449ced617227c27d36ab8","sha256":"1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615","sha512":"a45a01385d32c455b8e7601876a4e8cd2444993bb3a25b9b58937b19c767a23764a6a2b99c11fabe6d405ff3a4ceaf137c62ec2c9e142ce1207b0876bb87eb2f","ssdeep":"384:g8xTEBmqsHWJo+Fl9feef03Fvn6cxwkqsZ4JayZkQqLZNPdP/s26Olk9KIYRQ4T9:LOFsOYkcbQcxre9r0QTVcN","tlshash":"921339c7fad514d8a11b4252c6823bfcfdfb1814136aaefb91167b22db046fb4a1451c","first_seen":"2023-04-07T07:05:39Z","last_seen":"2026-08-13T18:16:44.110821Z","times_seen":4049,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.602Z","timestamp":1786644973602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TbFVrDLOdlik3Rd80OGszs73ALInGAHkaBh1PIJghVQvWSdafoOES7VWjGzOl%2BSZs3JIc7Qf0o56ZYoApWliKlE2AblT7Hb2n%2FYTi5zLuJDf%2FZobSCepFvXbtAdtXQmY54h58a7Pincf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5ad0d1532fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":682,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:17.719Z","timestamp":1786644977719,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wy1ae8DJYKPjzsvTJqc1ffQtqOHjE3KxwkWUll8vHKYcK0ZW01nXT4CW9ju1c6F3Ks1i%2FHmbKfcAMuEP%2FCvbm47i2XZVV4Wws05f4wI2tlHEo4O5PJaqfHurMJ934AVh24ZIWGB0au1S\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:17 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2a9b5c6ba3e32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":680,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:21.834Z","timestamp":1786644981834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:21 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xUZF9msPzXIv8lxDgl9%2BdDpPHH7WE18vEDIrt4Ee5hGlHSUgK9yA%2FZnmovywYZM5kTxgkhJ5ItA20MAFzZEGCK3tgEvP7SfJT9o7tQFmR7%2B8m9sG2sjyar1VUGHWsne4peGICRFN5xKT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5e0787a32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":682,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T18:16:12.796Z","timestamp":1786644972796,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/y4PIhBPQfUduDWyLtuqwcov0? HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://almistranaya.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L1E%2BuEUg3AvJdgNymg7djyWi9qKMHDNMl0X0ATQm4%2BxGQIiCLDVwWN%2BaXBmooGnR7Qx%2BUIFyLUGqaViRyvFeP5y3VeNfffaolJDSviwHtuiRkxStmR2SBz%2BI%2BV1hmOany0UhfRjEJPTN\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:12 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5a7fbf732fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bootstrap:5.0.2","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3522,"size_decoded":2038,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ee79ed89a78e7331c1802961b30ea5f0","sha1":"caa843a10ec5320893b9568c422a577adbe43543","sha256":"36f1b00380e2f9c0abdc98e5506d5c4952731bbdd84be17e14505c07ed8ae247","sha512":"044a6bbf83661535eb8ec5d6cd034bd5b7ca164eb341fa522c7b53c218a5470a78c5a6d905a6208bd5fa2f57998bed5a2b5e3147a0fcb8e9cdde49f9dfd357da","ssdeep":"","tlshash":"6971a41979f4484b1142d0d47df2b90c6ca6d20ba70d995836bd03ea3fd3e898c475ec","first_seen":"2026-08-13T18:16:44.11164Z","last_seen":"2026-08-13T18:16:44.11164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.17.207.5","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.141Z","timestamp":1786644973141,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 22 Apr 2026 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"65:D9:C4:7E:04:4C:FD:DD:60:E0:CC:18:B5:B7:01:68:B4:2D:C7:34","sha256":"50:6C:A4:F6:ED:74:C7:E9:68:DB:32:56:5A:68:4C:98:ED:01:28:36:F8:13:BA:CC:19:A7:FD:7A:0A:6E:E7:D4"}}},"request":{"raw":"GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 23224\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.0.2\r\nx-jsd-version-type: version\r\netag: W/\"13397-kBFpUnUH/55mLPZNjjYfNZMIlw0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-etou8220154-FRA, cache-bma-essb1270049-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nage: 1341593\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UfXBm8PD4mfyC26z3L%2BfVfZuUO%2FeplKzgbKlV40FkJ9m%2BUnxyJ3rX5in6BPguXggtO2%2BIm6ve5FXBJMcBz4bCscKZWvebqtFwZCahkutIIHyeQreYu6oogdaBTYxl6I0puM%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: a2a9b5aa3be60731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78743,"size_decoded":24374,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"0aa8d64e726c4a57adb5c88f9115996b","sha1":"901169527507ff9e662cf64d8e361f359308970d","sha256":"7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe","sha512":"ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f","ssdeep":"1536:tp+1ZTPR2t4tXbih05ve8/pwgrEpc9t0vSAIAxCs:MFRIpk0vSAV","tlshash":"a573d6493254b87309ee55a68037460bf3255994b14b802cb9bdadde2b3dc8272b7f78","first_seen":"2023-03-07T01:03:37Z","last_seen":"2026-08-13T20:06:54.159746Z","times_seen":24494,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":2,"send":0,"wait":6,"receive":1,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:36.199Z","timestamp":1786644996199,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:36 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=slqxWjXyvw6z66WEHTMIS%2FicRqB8xnoCtCizxQH7qXbXTmzwxc%2FT7xFyAcjNOMcOON5WoGqw6drHuIGrQH%2Fq%2B7cUZVjPZA%2By67MQ3MaFr%2BkBiX597ryRKQoDn%2Bl6thZpEld6uB3b8jvT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b63a3b2f32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/imgs/logo.svg","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.155Z","timestamp":1786644973155,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/imgs/logo.svg HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Thu, 03 Apr 2025 01:57:08 GMT\r\netag: \"1771-631d61659a500-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: image/svg+xml\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CHCI0fBhQSIffot6iNpQVZPoA9qUUBol8jrVEIQvPNIZE9A7ovga1D3I4id8FMiLp56LuDLe0tkE%2Fl5Lg6cAgSp5zWRHyhssalCh5CH5X8kMbyPMQ0dLz%2BtyNWgRgm5ICBqJqMsRbHPS\"}]}\r\ncf-ray: a2a9b5aa3c8632fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2581\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6001,"size_decoded":3343,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"49f17692c906e370cf34f0d50ee19562","sha1":"3e7e63898138bc7de158e673e3dad40ceb943b97","sha256":"48a40d5cf5f37004aae591264ae24d19e680f3c3ab52998a1c8a55ed299d3705","sha512":"0dbfe9ba775df2fe9c547c3d91bfd32dd844024eb0ca1f9beed0b235422ad2319d2c5033acb697e6e2fbc692134b82358cfbeec66f26a1753b3e53f82180288f","ssdeep":"96:sAi8qmZn+AbQSa2sBshQpscxJlCYtO7miaJAbCzplOtiPy1ZsaI6/s+APPgC0+:sX8qmZn+AEEsqxcxyz7aaWzplOAAsaIH","tlshash":"dcc1d9dd13f412d4ec06c7d3b90194b8b056a9ff1ba182ecd2469e1cada103e8d09ed7","first_seen":"2025-04-07T11:53:08.850329Z","last_seen":"2026-08-13T18:16:44.114252Z","times_seen":72,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Monomakh\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.173Z","timestamp":1786644973173,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:43 GMT","end":"Mon, 12 Oct 2026 18:07:42 GMT"},"fingerprint":{"sha1":"3C:2E:4A:58:D0:DB:8D:00:50:7D:0E:E6:87:DE:CA:95:B3:BA:1B:89","sha256":"C2:4F:05:DF:4B:24:E4:A9:E4:2A:30:66:F4:78:E7:75:AC:AE:71:43:E7:DA:3E:24:4B:A3:AA:9A:39:4E:E2:E1"}}},"request":{"raw":"GET /css2?family=Monomakh\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 13 Aug 2026 18:16:13 GMT\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1455,"size_decoded":1159,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e30e5c15def535c347f664d4f65a4b85","sha1":"e212a48c121f9d353e75046d34fc039190897fbc","sha256":"5d03653f393b1d53c0c378a3d2496732be8d21055885125fe2d6b80a966f27ff","sha512":"dff7c3e6a733b9c12f16f81b29baaa701f3f82374cda8a9897a9e1c89a6dfdea2d668a4f935b6712b9304cd2f591191b5a1d4c17cc5cd66a3e9e60e5672ea2b3","ssdeep":"","tlshash":"8231ebf1006b9504eb8b1cc223ce7f36ae1e91503111d8669bfe0cacbcabc615354b2d","first_seen":"2026-07-29T08:08:04.748109Z","last_seen":"2026-08-13T18:16:44.115011Z","times_seen":11,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":1,"connect":14,"send":0,"wait":32,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.536Z","timestamp":1786644973536,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:39 GMT","end":"Mon, 12 Oct 2026 18:07:38 GMT"},"fingerprint":{"sha1":"12:E8:CE:14:FC:4E:1E:0D:A3:9B:2E:5D:D0:88:79:79:71:C9:F8:6A","sha256":"58:07:B9:A1:6C:54:97:F9:9D:6A:66:E2:49:57:FB:86:86:8D:12:97:8F:4A:C9:74:A1:9D:69:4E:1F:A6:CC:9D"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://online-zahlung-info.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 13 Aug 2026 10:17:38 GMT\r\nexpires: Fri, 13 Aug 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 28715\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43948,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-13T21:52:08.733406Z","times_seen":261427,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":27,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.537Z","timestamp":1786644973537,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:39 GMT","end":"Mon, 12 Oct 2026 18:07:38 GMT"},"fingerprint":{"sha1":"12:E8:CE:14:FC:4E:1E:0D:A3:9B:2E:5D:D0:88:79:79:71:C9:F8:6A","sha256":"58:07:B9:A1:6C:54:97:F9:9D:6A:66:E2:49:57:FB:86:86:8D:12:97:8F:4A:C9:74:A1:9D:69:4E:1F:A6:CC:9D"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://online-zahlung-info.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 13 Aug 2026 10:17:38 GMT\r\nexpires: Fri, 13 Aug 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 28715\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43948,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-13T21:52:08.733406Z","times_seen":261427,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":32,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:25.941Z","timestamp":1786644985941,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:25 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OecD9L7KOIwDeX86Ffuj30UgPZH%2BYEefDPLkl4OR3KUnK2wT3HBeEszUt%2FxFVvjS6m%2BXI7hZCN6RoTfTWFmKdI5ekE9gjATs2O5qOvGtrQGK8P7Iy%2F%2FrCBoerKyFKvdUR%2BY8g1LZN%2FJh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b5fa1de132fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":690,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/z-index.php?waiting=1","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:27.995Z","timestamp":1786644987995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/z-index.php?waiting=1 HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\npriority: u=3,i=?0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 13 Aug 2026 18:16:28 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ls9ULdGzAjK6M%2FNwy4fZb34ANe4CciWBgiFQ4q8Te6HnPyvLxc4ndJX0LP1jqxM0Q2qu8b58%2FVi5VhWSEi1wehVTiIARlJXLnxYinBmAy4xzT4kuwI5BY4dD%2BE6PHQZgSqznzSBc4XBV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2a9b606f8e432fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":682,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"almistranaya.com/","fqdn":"almistranaya.com","domain":"almistranaya.com","tld":"com"},"ip":{"addr":"104.21.2.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T18:16:12.264Z","timestamp":1786644972264,"http_version":"HTTP/3","security_state":"secure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: almistranaya.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 29 Jul 2026 06:09:18 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rtNCxHweCNQ2GTXEyTlXs0Uz2UfQs7qfBEU60%2FOTIkeROYaqF27bA%2BnAO2ZkKP%2FWjsX4dkS7erV3kPt8Ot431y7kt26Dmw4PBqnJs1pk8XqVuyaJxtJ5aa0SCESSZV8rHbZJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncontent-encoding: zstd\r\npriority: u=0,i\r\ncontent-type: text/html\r\ndate: Thu, 13 Aug 2026 18:16:12 GMT\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a2a9b5a4df47b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T21:51:57.324612Z","times_seen":17876576,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"almistranaya.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"almistranaya.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/js/js.js","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.149Z","timestamp":1786644973149,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/js/js.js HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Wed, 13 Aug 2025 11:46:18 GMT\r\netag: \"468-63c3db46d5680-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver-timing: cfExtPri\r\ncontent-type: text/javascript\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=av8OQwy9sozQokNHlAfnny2RA4jYiEgZ8p8RAtR5BAgcUlYJqa64MRQUwGbI7gX5Yj7%2BOmUB91QLEvIPpGHdfRbl7mUSulbZNDZTAymasCT%2BimqEKcPYBQh%2FmJn2JQU%2F32TGEZUA5drU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a2a9b5aa3c8732fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 354\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1128,"size_decoded":1123,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (582), with CRLF line terminators","md5":"bd6047714ad98380627de6660942f6cb","sha1":"42f139b3c0300aa61a628fefd7bd0c840b441a83","sha256":"66e18c545137f9f9f53f7aafdeef741e942115e64028893ddeea47f043059fdc","sha512":"e0e35879b1200edc66ef7e72a8dd014fe08ca74dd550407a5ea1f14b83f3932972ef8a546533a0cc752d2912f6f9ed11c95597c38d6f999833728ae81ae081ce","ssdeep":"","tlshash":"5721a128b930a8e150b7727f2d76dd04ea2d78af58096210b51d6c5cefbd248971291f","first_seen":"2026-07-29T08:08:04.754523Z","last_seen":"2026-08-13T18:16:44.115715Z","times_seen":11,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"online-zahlung-info.de/we/auth/assets/imgs/pdf2.png","fqdn":"online-zahlung-info.de","domain":"online-zahlung-info.de","tld":"de"},"ip":{"addr":"104.21.3.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?","date":"2026-08-13T18:16:13.156Z","timestamp":1786644973156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"online-zahlung-info.de","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 08:16:53 GMT","end":"Thu, 22 Oct 2026 09:14:33 GMT"},"fingerprint":{"sha1":"BD:22:09:EE:38:FD:BA:34:8A:FD:FA:1E:D8:60:22:D9:E8:BC:5C:D7","sha256":"B7:F4:71:AC:83:CC:D9:33:0F:AB:82:68:75:8C:9F:5E:EC:62:C9:25:18:1D:5E:0B:B6:53:C4:55:91:B4:B1:74"}}},"request":{"raw":"GET /we/auth/assets/imgs/pdf2.png HTTP/1.1\r\nHost: online-zahlung-info.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://online-zahlung-info.de/we/auth/y4PIhBPQfUduDWyLtuqwcov0?\r\nCookie: PHPSESSID=f5gr0va7q40jdg6rkj9csdr0uf\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Tue, 17 Jun 2025 23:35:15 GMT\r\netag: \"10c0-637ccf6e012c0\"\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ncontent-type: image/png\r\ndate: Thu, 13 Aug 2026 18:16:13 GMT\r\nserver: cloudflare\r\nage: 647\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eeykg10%2FOX2QxBKWdG%2BAicTtVKz%2BkAVf25FxF8ZnhmxamQJzTypjbtydY6G1WUulchL3%2BtkH8kMT4%2BPnV3jTLUS1eLYMcqv1teNHxYv2n9j9q6xAUj3klAcaVd4EovyQanEcocxfNsKi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2a9b5aa3c8832fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4288\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4288,"size_decoded":5000,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"f12caca4c57921a9dc5d8eb445bf4dd0","sha1":"3ce9bcfcfa4a0c55e66368a9661642da1b884cbf","sha256":"14988b94a4cc4ce28512b19002c0accce57e746c3d764d32648284f333d62eef","sha512":"0fd3cf7979b5dc76ec9ac88bd6c5b265dec2a8c0822f34ceacbc281dd1016c61de4ad2aaaf40135a9240bae299e67030251a5d9abbe06c807697cb0822a01ae6","ssdeep":"96:eDbZXQrwPRFr2iJLO5FBKpS1XPzmwZSPzQONQlG:2Or62d5DKpS1/zrEqlG","tlshash":"da918ee6520a18f794937351981b7ff2e9c0c5b34c1c6b0e617a6cd02d2764ba02075f","first_seen":"2026-07-29T08:08:04.746835Z","last_seen":"2026-08-13T18:16:44.11642Z","times_seen":11,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"online-zahlung-info.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"online-zahlung-info.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}}]}