{"report_id":"711ab55e-0013-4d4e-a6c9-48fdb8f33183","version":0,"status":"done","tags":["swisspass","phishing","transport"],"date":"2026-08-02T13:00:21Z","url":{"schema":"http","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":0,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"final":{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"title":"SwissPass","dom":{"size":23657,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (382)","md5":"fa6e4ba3329d994bf9bc974b1bdbb9c7","sha1":"be21621ac91806457e8ad5eb7d8adece0db63692","sha256":"37bee62c93c9e317060fba1c4e0e62192e81e811719292689a671b077c2e58a6","sha512":"f343aea78e948141d1cb1da0e4b64b7841502824470231b7c31bf0af5f484dd646d03d860ccdc5e91bce9f5f86ee0b636434f06e8225ebf32ea5f675ad4d2a9b","ssdeep":"192:nnJEqOpJdCYisVZfV9Phia/yEjPyZ5rxnRy8cMnRqC0gclS4KSW4KSMSNTgk+FQ7:nJynXXljInRy8cMnRqC0gcl5zPq1m","tlshash":"09b2c62190f6193b211780d96beb7f126ea2c703c5868418f6fe5bcd4fdad42da4366c","dom_hash":"domhashdf79ea452f2a3d5abd29caea199b72f3","first_seen":"2026-06-09T08:48:51.140699Z","last_seen":"2026-08-02T13:00:46.652743Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":0,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-06T13:00:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"summary":[{"fqdn":"upadat-29078.angelo-osl.servebolt.cloud","ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"domain_registered":"2017-12-21","domain_rank":0,"first_seen":"2026-08-02T05:50:17.591646Z","last_seen":"2026-08-02T05:50:17.591646Z","alert_count":14,"request_count":7,"received_data":360950,"sent_data":4158,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"resources.swisspass.ch","ip":{"addr":"141.101.90.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2017-02-16T17:20:22Z","last_seen":"2026-08-02T05:50:18.79899Z","alert_count":0,"request_count":1,"received_data":201988,"sent_data":615,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.app.sbb.ch","ip":{"addr":"35.157.41.168","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":2139371,"first_seen":"2018-04-04T14:01:55Z","last_seen":"2026-07-29T19:39:24.012474Z","alert_count":0,"request_count":1,"received_data":15020,"sent_data":573,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.31.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":true,"md5":"f9955ada9cfa079afa6865c325cee392","sha1":"bdf1f6859de9c1fb74ad962c01c23a67fb2674d6","sha256":"136c0326063dc3a607c2062aa5748d0f04f09fac6767bf5f776d97219739b7f6","sha512":"d9a1759238f88c621a725190d27eea1dd8f1c005896097708c20b10826b1cb95b19f2f496ffadbba2153e63e0508ad39f6a5c80fe15035d2f380d5a6a1e60bb6","ssdeep":"","tlshash":"08a002a8744250308d48505e712492d83c30550a7a026004916d41ba5462d949898966","size":67,"data":"","first_seen":"2025-07-15T09:43:33.685184Z","last_seen":"2026-08-02T13:00:46.662771Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":true,"md5":"7ff2985691fa48ff4023ae65b8ee45ef","sha1":"80a5d92716a11a1a495fc8bf20d7f345c3bfb449","sha256":"a42b333c20b94741a8d53df383bf6c3e65b67fa3ceea4a9e8f8742aa0fadaca3","sha512":"7b8849064d41025a367950362d3bff4414cafc31da3b3094b91e857194a4508c2a903e4b0854878f25bc806087dddeaea2e4b3d70bfb74194a40f90b92f3fb48","ssdeep":"","tlshash":"54319c1726b2593098f690f40e6fb92034b069135586d1d5bf1e9f044f0071b94327e9","size":1522,"data":"","first_seen":"2026-06-09T08:48:51.149526Z","last_seen":"2026-08-02T13:00:46.663651Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/Login%20_%20SwissPass_files/sso.min-20200819.css","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:54.879Z","timestamp":1785675594879,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/Login%20_%20SwissPass_files/sso.min-20200819.css HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 31 Jul 2026 20:28:51 GMT\r\netag: \"2ce5a-657ee095a26c0-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800, s-maxage=3600, public\r\nexpires: Sun, 09 Aug 2026 12:59:54 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 26429\r\ncontent-type: text/css\r\ndate: Sun, 02 Aug 2026 12:59:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":183898,"size_decoded":26807,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"de0cde3da62c59a02a94334920ae682e","sha1":"c51d409b4e80a87b70f9d06c8b04c68701d34c32","sha256":"da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a","sha512":"b87773149693fc4bb67af0003233d73376579fc6ad1ce5a23ae4ed41d2e601396c73b17e6713871c040a57d72b961209494ecbe34cede3dc4459801527d9040e","ssdeep":"768:K5ptYJ7mvjNiYXayvATzcGxwRv5FSN0k4PSw2w+gw2w+6ZkynBCb1z9FnUShWlwV:K/uJqHXayvAPFwWuWNL6tw4l","tlshash":"7304a8d6eae214ad372bc41fa4c16776173b9011fa572fb6f2d7946c8b883860223f45","first_seen":"2023-11-14T18:20:15Z","last_seen":"2026-08-02T13:00:46.655817Z","times_seen":485,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/logo-20200819.svg","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:54.889Z","timestamp":1785675594889,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/logo-20200819.svg HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-length: 236\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Sun, 02 Aug 2026 12:59:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":236,"size_decoded":390,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"54ddfcfcbac52ccc7451161d40934ad7","sha1":"3f9915360e96bd0c5c756209a62d99b0246a634d","sha256":"9448f8a1159c9b14e3e1b9d8eab1a6ddf88d26e1f888a34cef430c756e4e6e1e","sha512":"b5b31c06e9e8cfc08e09e90bc5ba77c970c5be644c109f14b4b430384d4cecefae4368e051ed96323cfd3fe7a0e9f4832025c2efd213aa64bf65c55625bd72e6","ssdeep":"","tlshash":"61d0a79e90939386415176907ec123d2654953ab78b143e96ec1944690086bdc0d919d","first_seen":"2025-12-07T09:00:18.523222Z","last_seen":"2026-08-19T12:42:20.398428Z","times_seen":7071,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/Login%20_%20SwissPass_files/loader-20200819.png","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:54.890Z","timestamp":1785675594890,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/Login%20_%20SwissPass_files/loader-20200819.png HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 31 Jul 2026 20:28:51 GMT\r\netag: \"110-657ee095a26c0\"\r\naccept-ranges: bytes\r\ncontent-length: 272\r\ncache-control: max-age=604800, s-maxage=3600, public\r\nexpires: Sun, 09 Aug 2026 12:59:54 GMT\r\ncontent-type: image/png\r\ndate: Sun, 02 Aug 2026 12:59:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":272,"size_decoded":595,"mime_type":"image/png","magic":"PNG image data, 24 x 24, 4-bit colormap, non-interlaced","md5":"1a7ca896940219da5393e26600e0ee7b","sha1":"558e1d3bad16b2faa7527f1f3133e21bf89cd507","sha256":"f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5","sha512":"29b51656a862e758fab0bad8b5cd18d68ed7f57a6fdd42b188d85dd1705234ed9956b15276baaa031d6f20d5049317d86bd13752aea03739183b9461b8d33863","ssdeep":"","tlshash":"a4d097c3c8be5c2aad60423393ca88278a232da010043243be36f829c73212889302d1","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-08-02T13:00:46.659383Z","times_seen":1752,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg","fqdn":"resources.swisspass.ch","domain":"swisspass.ch","tld":"ch"},"ip":{"addr":"141.101.90.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:55.096Z","timestamp":1785675595096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"swisspass.ch","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Jun 2026 11:57:18 GMT","end":"Tue, 15 Sep 2026 12:57:15 GMT"},"fingerprint":{"sha1":"E5:3E:7E:74:2E:3F:06:20:F3:37:C0:92:A4:C1:3E:D6:33:B7:43:B4","sha256":"F2:46:44:51:F6:97:8F:73:7E:64:C9:C1:B7:7E:59:35:D0:03:1B:94:0A:AA:7D:56:C3:3D:C2:20:33:89:D5:B5"}}},"request":{"raw":"GET /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg HTTP/1.1\r\nHost: resources.swisspass.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 02 Aug 2026 12:59:55 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 200933\r\nserver: cloudflare\r\nset-cookie: __cf_bm=JrcnpBpcjtTCQo_0muowkktXGA2iquRlYSfYn4L4xBc-1785675595.205783-1.0.1.1-_z6O43KTB1JVAr7hK_8sIiLe87ihwmK3EOWaiVswv9CM2BfmVUHSUJhPWg5fCMYCtgWuIUruUZHatI_62zGYau3NzH7n4yjzCCLw7Nf9gYkKQl2RDFWjkMZE8NTO2EgG; HttpOnly; SameSite=None; Secure; Path=/; Domain=swisspass.ch; Expires=Sun, 02 Aug 2026 13:29:55 GMT\r\nlast-modified: Mon, 06 Jul 2026 08:20:05 GMT\r\netag: W/\"310e5-655ecf10c30d6\"\r\ncache-control: max-age=2592000\r\nexpires: Wed, 05 Aug 2026 08:20:05 GMT\r\nx-plattform: cprod\r\ncontent-security-policy: frame-ancestors 'self' https://www.sbb.ch\r\nx-url: /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg\r\nx-varnish: 205821111 203512689\r\naccept-ranges: bytes\r\nx-cache: HIT\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=16070400; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\nage: 2349403\r\ncf-cache-status: HIT\r\ncf-ray: a24d43360c518d62-HEL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":200933,"size_decoded":201988,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1563x1198, components 3","md5":"0f80ca4a78ce3af79ad01923484e0a5b","sha1":"fac97c21d7965e9ac6950844123fd5f65b8f0a77","sha256":"58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b","sha512":"f3e0ddf9685e0ef455bacd6691805d45e08a3377c23105e3cc0adb3ad1e31d8ef84fac8eab3762ce19ce4c77692be967d0ab8463678a1bc26e2489d71866d5e9","ssdeep":"3072:I18uz9aobkEofvj340bjX0glkFFSa2JWarVH7p4LDZVO8cIin9YxDie+:I1bRpMvs0iOWEVHl8rnin9Yhx+","tlshash":"351412b2eba666e2d063103ec1389172b4ce49bcda0dd21f0504aee756b75ff5a1702d","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-08-03T06:05:54.359545Z","times_seen":831,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":58,"connect":1,"send":0,"wait":37,"receive":23,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2","fqdn":"cdn.app.sbb.ch","domain":"sbb.ch","tld":"ch"},"ip":{"addr":"35.157.41.168","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:55.102Z","timestamp":1785675595102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.app.sbb.ch","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sat, 16 May 2026 00:00:00 GMT","end":"Sun, 29 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"58:48:EC:2D:9E:BF:09:51:F2:03:47:36:3A:2C:29:C7:72:36:FA:B7","sha256":"E3:B6:7F:F1:64:99:E9:B3:D5:7A:D2:1A:B7:1A:F6:66:1B:2D:1A:F8:83:99:8E:34:D5:B9:81:98:84:62:EB:0A"}}},"request":{"raw":"GET /fonts/v1_6_subset/SBBWeb-Light.woff2 HTTP/1.1\r\nHost: cdn.app.sbb.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://upadat-29078.angelo-osl.servebolt.cloud\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 02 Aug 2026 12:59:55 GMT\r\ncontent-type: application/font-woff2\r\ncontent-length: 14212\r\nserver: nginx/1.31.2\r\nlast-modified: Fri, 27 Jun 2025 13:56:18 GMT\r\nvary: Accept-Encoding\r\netag: \"685ea302-3784\"\r\nexpires: Mon, 02 Aug 2027 12:59:55 GMT\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With\r\ncache-control: max-age=31536000, public, private\r\naccept-ranges: bytes\r\nset-cookie: 9527f1a32486d650b0687919ffd41c2b=6aab6b08b17abfd868a4e989f471910c; path=/; HttpOnly; Secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.31.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14212,"size_decoded":15020,"mime_type":"application/font-woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14212, version 1.0","md5":"8b70a44a98a0ac5d721df7d8f5136f7b","sha1":"10e10c01e732f3d35a78e1051bfcc9fe2589ddda","sha256":"5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf","sha512":"65833d65ef11617a6d2d2a9c2ed81fc7079368da6f9569b56404fa5a66d878088d95c5632b216d0e6c7f3e40aea6a6d7df5b9c0147743ecc06f38e95508397f2","ssdeep":"384:5bJ1keL4/s04W4gUz+/1x55hsno5oky9RAl51Gx:ZasaD/V5hsnDVyC","tlshash":"a652d017c934adb9c708cc34b49e35b2cc2e9ad444a2382c57c7a1b9370a9d36e54e4d","first_seen":"2023-04-05T05:09:02Z","last_seen":"2026-08-02T13:00:46.661936Z","times_seen":2633,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":17,"connect":21,"send":0,"wait":45,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/Login%20_%20SwissPass_files/favicon.ico?v=20140709-1126","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:55.275Z","timestamp":1785675595275,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/Login%20_%20SwissPass_files/favicon.ico?v=20140709-1126 HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 31 Jul 2026 20:28:51 GMT\r\netag: \"47e-657ee095a26c0\"\r\naccept-ranges: bytes\r\ncontent-length: 1150\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Sun, 02 Aug 2026 12:59:55 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1150,"size_decoded":1395,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"6d866d9c4568bf7fc03e597e74ce7e28","sha1":"e1b3d9f0e9cdcb785a94b6c1e1fe651a4ff98dcb","sha256":"7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677","sha512":"7dc58e58fc991e2c9310e22a6761aaa398586082c13fd7863fcadd48e15cef8ed7337dc33d0acc0d0b9b698d4d26abbbe6995fa48d2c9ce1161b2f39fea2a381","ssdeep":"","tlshash":"53215d85ffcbd895e413ed317a81e1862c584d61eab09d8130a1f4ebeb716744c54778","first_seen":"2023-05-05T11:25:27Z","last_seen":"2026-08-10T12:28:55.912536Z","times_seen":2772,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-02T12:59:54.463Z","timestamp":1785675594463,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/sign.php HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-backend-delay: 1.896\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-frontend-cache: MISS\r\ncontent-length: 5072\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sun, 02 Aug 2026 12:59:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":26693,"size_decoded":5317,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (347)","md5":"c1c23fa2a85deba3020f30dfe4f72eef","sha1":"2495afbb6ff52162bf4832f98f4556ab4b23be7f","sha256":"8638a52d1eb34b482087301c429556fbe15bf45e171a76fc286b19a60fcf17ab","sha512":"6dca4a444aebca3118d5bb09b44a6cb04aa77db82945f279ece9d1cd844e9b21dd174faa8b2c9e27295ed9c7713de80d037baa8ef005af4eff5e8f15df02619e","ssdeep":"192:RtnEzOpJdCYisVZNVGwia/yEjPyZ/0CnRM8cmnRqC0gcl8KWSUKWSfKwNT+k+hQP:RVFnVrjanRM8cmnRqC0gcl5rhVs1dM","tlshash":"d2c2b51150f6193b211b80e96bfb7f126ea2c703c5868418b6fe5acc4fdad42d65366c","first_seen":"2025-05-01T13:10:05.674844Z","last_seen":"2026-08-02T13:00:46.654931Z","times_seen":27,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":5,"connect":1,"send":0,"wait":208,"receive":0,"ssl":7},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/logo_text_de-20200819.svg","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:54.884Z","timestamp":1785675594884,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/logo_text_de-20200819.svg HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 31 Jul 2026 20:28:50 GMT\r\netag: \"222c3-657ee094ae480-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=604800, s-maxage=3600, public\r\nexpires: Sun, 09 Aug 2026 12:59:54 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 21457\r\ncontent-type: image/svg+xml\r\ndate: Sun, 02 Aug 2026 12:59:54 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":139971,"size_decoded":21840,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"512410d9227bb0c2481e175dce0eda72","sha1":"1deb5d9f09592101e632a8351865d54b1d6a27f7","sha256":"c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07","sha512":"855feb227bb9448de654bf5c616a2dbf71c4f97550a00a30372cb0ae2f7b0bd70b7a4430d84c8386934b7064d8bc3f66e926b5b2dd9920812af96c3469743a86","ssdeep":"1536:mYtjakc0aZDT/Zs4sC0jfjR1YG+s2Ltt99ac0eW53zzVCoYs2rhrXzgEA6SJB5LQ:j5E2tvYkUv1","tlshash":"37d3a716436884e8b59f45f13cd41d0a2a5a98e723125919faae8c31dff3ef3d382b45","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-08-02T13:00:46.656753Z","times_seen":2255,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/icomoon.woff2","fqdn":"upadat-29078.angelo-osl.servebolt.cloud","domain":"angelo-osl.servebolt.cloud","tld":"servebolt.cloud"},"ip":{"addr":"185.91.67.250","port":443,"asn":50304,"as":"Blix Solutions AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php","date":"2026-08-02T12:59:55.104Z","timestamp":1785675595104,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.angelo-osl.servebolt.cloud","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 05:11:24 GMT","end":"Sun, 30 Aug 2026 05:11:23 GMT"},"fingerprint":{"sha1":"B8:BE:C0:61:C5:BF:0A:B5:09:D0:3C:F1:7A:3E:D2:42:72:AE:ED:16","sha256":"83:09:52:A8:D0:9A:61:1D:25:00:F1:39:01:AE:48:0E:45:9B:D9:91:CD:D3:FC:B9:45:31:15:76:0D:9C:55:45"}}},"request":{"raw":"GET /wp-adult/upadt/icomoon.woff2 HTTP/1.1\r\nHost: upadat-29078.angelo-osl.servebolt.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://upadat-29078.angelo-osl.servebolt.cloud/wp-adult/upadt/sign.php\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 31 Jul 2026 20:28:50 GMT\r\netag: \"1a14-657ee094ae480\"\r\naccept-ranges: bytes\r\ncontent-length: 6676\r\ncache-control: max-age=604800, s-maxage=3600, public\r\nexpires: Sun, 09 Aug 2026 12:59:55 GMT\r\ncontent-type: font/woff2\r\ndate: Sun, 02 Aug 2026 12:59:55 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6676,"size_decoded":7002,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 6676, version 1.0","md5":"76d0b40f597b59510e88eeec38c1add3","sha1":"ef6ce2a484f4c6df2d23d0da6428f7a1ee2701a0","sha256":"78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d","sha512":"f64e7aa2fa1a44fa2cf2a3808ce805dde0ab0b8b394c5de08006414e87bc8a954bd8c5c36741a496cad0ba8d3538cc849a641bbfbd9b6c0060da8eb38c5f408a","ssdeep":"192:Yj+/sYxUGGNiida/2tMJCFwphT6hUr+Y8FK6L/EBzUh:Ya/sYxUGyiidaCOnTwUaY8FK6L/","tlshash":"f7d19edff928367edd6a3ffb500084275a698bc7f0b10b1809cf4c4e853869749a6c58","first_seen":"2023-10-29T08:06:10Z","last_seen":"2026-08-02T13:00:46.660263Z","times_seen":587,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"upadat-29078.angelo-osl.servebolt.cloud","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}}]}