{"report_id":"72ce6ece-062b-41eb-bebf-f62eb9ed9504","version":0,"status":"done","tags":["swisscom","telecom","phishing"],"date":"2026-08-18T03:10:33Z","url":{"schema":"http","addr":"url1924.medicardmalta.com/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D","fqdn":"url1924.medicardmalta.com","domain":"medicardmalta.com","tld":"com"},"ip":{"addr":"46.51.200.92","port":0,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"final":{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"title":"Swisscom Login","dom":{"size":19815,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17300)","md5":"3bf79b5e9b34fed3c6f35b399e54dd56","sha1":"299a89604372cb0eac18601f016e5052d24aa343","sha256":"3fabb4596f71a0f5e1923f1d19566522903f734d42da6154f53a32847454fb49","sha512":"05f21b6603a92cae1397bf050cc9063478938a3cf59aeb601c129361301bde3005bfa5b788f8f294c53ea65090ea131e8e9ecc3331975a0244062ac30b3095d5","ssdeep":"384:780ZMVM0FMVM0BMVM0uMVM0gMVM0ZMVM0LMVM0ANspuoamIQOiu:JMVM6MVM+MVMfMVMnMVMsMVMUMVMvspm","tlshash":"ce92bedb548272698d175e6343cc191c99389ea34a525d9eb22e1409afc7ff823d333b","dom_hash":"domhash7d6f9dd20fc7a1a40a0fa880a4fe0b62","first_seen":"2026-07-09T00:48:48.8618Z","last_seen":"2026-08-18T03:10:36.804941Z","times_seen":11,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"url1924.medicardmalta.com/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D","fqdn":"url1924.medicardmalta.com","domain":"medicardmalta.com","tld":"com"},"ip":{"addr":"46.51.200.92","port":0,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-22T03:10:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"nuan.boombeachx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"url1924.medicardmalta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"url1924.medicardmalta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-16T22:46:07.924415Z","alert_count":0,"request_count":1,"received_data":1465911,"sent_data":527,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-16T22:23:57.509837Z","alert_count":0,"request_count":1,"received_data":8946,"sent_data":562,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-16T22:20:46.906465Z","alert_count":0,"request_count":3,"received_data":65687,"sent_data":1712,"comment":"","tags":null,"fingerprints":null},{"fqdn":"nuan.boombeachx.cn","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2024-03-08","domain_rank":0,"first_seen":"2026-08-18T02:05:36.465481Z","last_seen":"2026-08-18T02:05:36.465481Z","alert_count":2,"request_count":2,"received_data":268,"sent_data":972,"comment":"","tags":null,"fingerprints":[{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"IIS:10.0","description":"Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.","website":"https://www.iis.net","common_platform_enumeration":"cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*","icon":"Microsoft.svg","categories":["Web servers"]}]},{"fqdn":"162.89.74.97.host.secureserver.net","ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"domain_registered":"1998-03-30","domain_rank":0,"first_seen":"2026-07-31T15:49:43.010506Z","last_seen":"2026-08-14T16:47:07.906032Z","alert_count":42,"request_count":14,"received_data":505349,"sent_data":8613,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"url1924.medicardmalta.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-29T06:41:05.657835Z","last_seen":"2026-08-18T02:05:41.062836Z","alert_count":4,"request_count":2,"received_data":270,"sent_data":1634,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-18T06:22:21.942341Z","times_seen":267448,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"cabc5d07dec4c381f521bbcd41c009db","sha1":"ca329d086682a4d75b5528d326a66a6d3fffab13","sha256":"2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9","sha512":"66f6e36c99f2b57f526b4dff01c6cffe787d2bde6d6abe11d080314d2da08760a18889de7ebd6bec4a675429694d650437b55aaef12c1f7aaebe463587474016","ssdeep":"768:+hkw5E0MWirtTVU4t8GMqm7MT8VbdPyqzgqqqLWpeki3iMFpnkIID0Jhp6zvsv1z:+Z2TTktMqTiaDkIxIzcn","tlshash":"ef538249b254787206df747a817b460bb73a2899a046813cb97ad8dd1f7cc893173fb8","size":62411,"data":"","first_seen":"2023-03-07T01:02:38Z","last_seen":"2026-08-18T03:10:36.813035Z","times_seen":2553,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","size":23176,"data":"","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-18T03:10:36.809124Z","times_seen":4244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"40bd440d29b3a9371b0c63fec41ee64f","sha1":"e790c26449c57de298923c686cb3434d1d461a1d","sha256":"dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48","sha512":"50326d2577f37ec88f3e09c8e52d74d3414f2c11cc86fcc0317d7923ea86d84d8e0330bd3f527353024e7e7ca95e2387ecc44f6aace13db0460cd363ef305fa0","ssdeep":"","tlshash":"4751a8857062714a8b2f11ab917f970ff5e452a6d8580060d0e9c87cf930df8c2bbf65","size":2730,"data":"","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-18T03:10:36.808225Z","times_seen":1844,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/respond.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"78915bb8b3dd6696d3842d82ed48b104","sha1":"504cce482567765d63843d7b9d00c4195109c449","sha256":"1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e","sha512":"fae71ebe045ce6a2c190b47bda2a0dd9f042c659c8225f566a31ddf1872de61048b99efcb9d9dfb02860e5304940b30c1dfcfdc00c96424f6e97374738139fcf","ssdeep":"96:fmeKAql8GALKZ2sdX0MVrpezoG3+gTYkhs7/tQMBze2EOgSUHB75h0:fnqSGTZbvVrpezoVgdSjtQMle2EOgSIc","tlshash":"a891c8a422203548e2ea3825967f4226f8739cb575584890d515e8b83da8fed10f7ff7","size":4593,"data":"","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-18T03:10:36.808759Z","times_seen":477,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0b7e001e9f8a42f5ac1c1cd612b4a66","sha1":"9ff3cfb2e15856f9b77bdda2661876614f46a245","sha256":"75ca5d1ab7947e7c19b4914a8ebaf31f5ef8547fee7fe3c4b49125fa9159fee4","sha512":"c858d96d3611089a1d9eec8696c29a98d13f2e511a100c525037b9faeeb5995f33cea25514e1fb4e750b136fcf3ff979bca5a950d9c5e1519591787732380bb2","ssdeep":"6144:+ZmgvFsUIY0mRrSWAept/X8Xt6kXTfyGmlvWyHjmhu9kO0n6FUwumFbMSAwLc/d:4qUD0JPvgJmhulEoMSlLc/d","tlshash":"8e65c56c97a193fc5d6ac3e18e2040b47d8f96ee7650a33cd279c670b1625ecc5c8c9a","size":1464905,"data":"","first_seen":"2023-03-07T13:17:59Z","last_seen":"2026-08-18T03:10:36.815673Z","times_seen":623,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWHBXyXfDDVXbF6iGmd8WA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:11.308Z","timestamp":1787022611308,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/mukta/v17/iJWHBXyXfDDVXbF6iGmd8WA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://162.89.74.97.host.secureserver.net\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 21604\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 12 Aug 2026 13:16:22 GMT\r\nexpires: Thu, 12 Aug 2027 13:16:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 482029\r\nlast-modified: Mon, 08 Sep 2025 18:06:38 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":21604,"size_decoded":22417,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21604, version 1.0","md5":"a4069cc515298ca7af2e063e345637d9","sha1":"b018c88e2e32e61c76015e56b268ddac3fc710a7","sha256":"1907b5bc922c15f4eb0543ea00704cb366745b913656dd3264d5e6db03e1e276","sha512":"c075cc1cd21187b6a1f13c9c73609c04df2c397573f3f96e0a11e9696c89366330de4b4a48e2fcab3cc08733b0a43a19d6560172aa4c3111bbc800741f234ec5","ssdeep":"384:uc1/VSJcD+oGqKL0rN8bwgBZh9ffkeBtapFpQzbxh1rLl+7MoNUOiC23QsP0/Zzt:uA/XtGJ0c/h9EYsQzNjrLl+Xd72A/Zzt","tlshash":"51a2d04f89d3666dda70273a108d0c79adc830c3b5158a5643261f450edfab7c4dbda6","first_seen":"2024-11-12T22:29:28.721882Z","last_seen":"2026-08-18T06:07:18.143382Z","times_seen":1033,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":22,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nuan.boombeachx.cn/wp-includes/rest-api/dq1uzka/unsubscribe/","fqdn":"nuan.boombeachx.cn","domain":"boombeachx.cn","tld":"cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:05.426Z","timestamp":1787022605426,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-includes/rest-api/dq1uzka/unsubscribe/ HTTP/1.1\r\nHost: nuan.boombeachx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"nuan.boombeachx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"nuan.boombeachx.cn/wp-includes/rest-api/dq1uzka/unsubscribe/","fqdn":"nuan.boombeachx.cn","domain":"boombeachx.cn","tld":"cn"},"ip":{"addr":"216.118.229.213","port":80,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:07.529Z","timestamp":1787022607529,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-includes/rest-api/dq1uzka/unsubscribe/ HTTP/1.1\r\nHost: nuan.boombeachx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nContent-Type: text/html; charset=UTF-8\r\nLocation: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE\r\nServer: Microsoft-IIS/10.0\r\nX-Powered-By: PHP/7.4.33, ASP.NET\r\nDate: Tue, 18 Aug 2026 03:10:08 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]},{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"IIS:10.0","description":"Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.","website":"https://www.iis.net","common_platform_enumeration":"cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*","icon":"Microsoft.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":1275,"timings":{"blocked":-1,"dns":3,"connect":164,"send":0,"wait":1108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"nuan.boombeachx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:08.809Z","timestamp":1787022608809,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:09 GMT\r\ncontent-type: text/html\r\ncontent-length: 162\r\nlocation: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":1124,"timings":{"blocked":0,"dns":57,"connect":266,"send":0,"wait":266,"receive":0,"ssl":536},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.582Z","timestamp":1787022610582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/jquery-3.5.1.min.js HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Nov 2020 08:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5fbcc1d2-15d84\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89476,"size_decoded":31674,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-18T06:22:21.942341Z","times_seen":267448,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/image/re.png","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.593Z","timestamp":1787022610593,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/re.png HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 21 Feb 2024 00:15:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65d540aa-11a9\"\r\nexpires: Thu, 17 Sep 2026 03:10:10 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4521,"size_decoded":5064,"mime_type":"image/png","magic":"PNG image data, 277 x 67, 8-bit/color RGBA, non-interlaced","md5":"020fc8f7ba7a2303202b1ad697f8d5c2","sha1":"8d67bafe11f462c77b79cf2f143b79bca2b3bb17","sha256":"c93e75c73d7e0ec67c15f7a18db4a0b0bcb3d22f625f542bb5b16775401c5145","sha512":"65e924c52bb1f737a768f9f0b84699be3884cd133503419698f2413124a1deee17bd82059b4a49d5e09731b50319ad9d09d3cd5f093eb50fc753cbe082f10f32","ssdeep":"96:oD91rj8CPpRG0dGXwEzBaM1NErX3KXEcuuTMooTgeZof30+:oDrNhY0EAABaMzErq0ygovffd","tlshash":"0e918daf13335bc68d0392234cd19423bd28e327e5486d15977f5b6a8228fa1ea35b40","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-18T03:10:36.807205Z","times_seen":49,"resource_available":false,"data":null}},"time_used":1047,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1047,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWHBXyXfDDVXbFqj2md8WA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:11.309Z","timestamp":1787022611309,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/mukta/v17/iJWHBXyXfDDVXbFqj2md8WA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://162.89.74.97.host.secureserver.net\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 21164\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 13 Aug 2026 07:58:17 GMT\r\nexpires: Fri, 13 Aug 2027 07:58:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 414714\r\nlast-modified: Mon, 08 Sep 2025 18:06:19 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":21164,"size_decoded":21977,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21164, version 1.0","md5":"b4c317e3a2107dd8a7bfe722ed2b0d03","sha1":"fa474b4832c6505cebe6152a4d9becb272bb828e","sha256":"e304e9c80a75b34cfe0180c83ce8f401cc61c570078c726af863f19bb1f2f4e3","sha512":"0695af22fbea402e2812ff668cff5f86bd93111b955263967b32c72d4ae2ecdf9cc8f3e4704ed94eff4071a4935926ac20a2561f55150b47bed8566a005450ed","ssdeep":"384:IPNpOAlGoA2PSzWwPJHJubXULzU7i6Rcg0fHB/p5qkUdSGOmwJbybL55BFTx8zky:IP3OA0n2PJwPJHJPE7iLfHVjmww1lNmp","tlshash":"8292d00f2e45971dfa0a5a7cf09f708a0c20d619ed64665bbdeb6114624abbfbc1c702","first_seen":"2024-11-12T22:29:28.713783Z","last_seen":"2026-08-18T03:10:36.807725Z","times_seen":391,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":28,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.575Z","timestamp":1787022610575,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/html5shiv.min.js HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Aug 2017 05:37:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"599bc322-aaa\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2730,"size_decoded":1874,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2639)","md5":"40bd440d29b3a9371b0c63fec41ee64f","sha1":"e790c26449c57de298923c686cb3434d1d461a1d","sha256":"dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48","sha512":"50326d2577f37ec88f3e09c8e52d74d3414f2c11cc86fcc0317d7923ea86d84d8e0330bd3f527353024e7e7ca95e2387ecc44f6aace13db0460cd363ef305fa0","ssdeep":"","tlshash":"4751a8857062714a8b2f11ab917f970ff5e452a6d8580060d0e9c87cf930df8c2bbf65","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-18T03:10:36.808225Z","times_seen":1844,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/respond.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.576Z","timestamp":1787022610576,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/respond.min.js HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 27 Jan 2017 14:50:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"588b5e2c-11f1\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4593,"size_decoded":2744,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4453)","md5":"78915bb8b3dd6696d3842d82ed48b104","sha1":"504cce482567765d63843d7b9d00c4195109c449","sha256":"1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e","sha512":"fae71ebe045ce6a2c190b47bda2a0dd9f042c659c8225f566a31ddf1872de61048b99efcb9d9dfb02860e5304940b30c1dfcfdc00c96424f6e97374738139fcf","ssdeep":"96:fmeKAql8GALKZ2sdX0MVrpezoG3+gTYkhs7/tQMBze2EOgSUHB75h0:fnqSGTZbvVrpezoVgdSjtQMle2EOgSIc","tlshash":"a891c8a422203548e2ea3825967f4226f8739cb575584890d515e8b83da8fed10f7ff7","first_seen":"2023-03-07T12:03:04Z","last_seen":"2026-08-18T03:10:36.808759Z","times_seen":477,"resource_available":true,"data":null}},"time_used":533,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":533,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.585Z","timestamp":1787022610585,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/jquery.mask.js HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2020 22:30:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5e7a8a18-5a88\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23176,"size_decoded":6439,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-18T03:10:36.809124Z","times_seen":4244,"resource_available":true,"data":null}},"time_used":1055,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1055,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/image/le.png","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.590Z","timestamp":1787022610590,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/le.png HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 21 Feb 2024 01:03:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65d54bc8-182b6\"\r\nexpires: Thu, 17 Sep 2026 03:10:10 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98998,"size_decoded":99510,"mime_type":"image/png","magic":"PNG image data, 485 x 618, 8-bit/color RGBA, non-interlaced","md5":"e4d42741c0b226ade31ee8e351614256","sha1":"9a101852d626d820ee2211f3458681510d6ce74f","sha256":"5bf09d7de18b50a0f421b919a5934b532ef1b46b82801294fd6a1b8e1cc5aba5","sha512":"0f4afc961b280682046e41b0f26deef2d35922ea1f0fca0154ebb2b69f41014d417c7b0d3958e9e29dff01c7942fc8cecc73b01e413613c70b82bac69a20f806","ssdeep":"1536:W/uuu5t80GjYKcjbupGRjvnF4JK4jApocPeId6FYdQfFm2Zrf6ur/xUQKsJkJSY9:PuIcjYh+pg/aJ/Apo26FvFlYsJl3+F","tlshash":"86a312a752e4d3d8e118aac3c70a8e0ace0d5968b31ae71efcc6f537530e5d448a52d3","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-18T03:10:36.80966Z","times_seen":48,"resource_available":false,"data":null}},"time_used":1049,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1049,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/image/lg_ft.png","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.594Z","timestamp":1787022610594,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/lg_ft.png HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Oct 2022 08:30:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"63579ec0-828\"\r\nexpires: Thu, 17 Sep 2026 03:10:10 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2088,"size_decoded":2628,"mime_type":"image/png","magic":"PNG image data, 36 x 54, 8-bit/color RGBA, non-interlaced","md5":"9babe7d8ee8b71fa4e2d182a9e00ecad","sha1":"65611d3262c80efd253dc48c1cc02b2972cbbce3","sha256":"5922e6cdf9697c4715890db143a911157ec694af68dd2b63a9b72a25dc498f91","sha512":"35124cf5b61eb79b6e8476bcd12520d4dbd424c8b9006dd7eb0deae64f91adce3834ae27203a109cbc1665ab57005119d1bc9a15c76dffb0508c2061dbdeccf3","ssdeep":"","tlshash":"6a411896562041b0c85a8d2728e1a114a2821c1e9720dcfa893d8cdbede786ab56b11a","first_seen":"2024-03-02T07:44:40Z","last_seen":"2026-08-18T03:10:36.810196Z","times_seen":47,"resource_available":false,"data":null}},"time_used":1047,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1047,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/image/logo.svg","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:11.914Z","timestamp":1787022611914,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/logo.svg HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:12 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 21 Feb 2024 00:10:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65d53f68-1813\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6163,"size_decoded":3033,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"38be0de766af1aaa475f946c32b47944","sha1":"646ff2fae3c8080da7c067e6506f1a1193b9cfc8","sha256":"330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4","sha512":"20feebf7e0888ac048f0fbcd8c09c748df432ed946460c886dcdf89b49da98cc9a2af35116b3b28a0f30a1c0d3cae36856d2719dca35f97693aa2fa310c56bb2","ssdeep":"192:9D/pNzACPyEwZ+p5M3TFITYJxSWRRZblnPpl8FL:RpNzACPpK+v+OYJxSWRbblnPpGFL","tlshash":"e0d14fc7a314d3ade9c5d21def62d854a20f60fbf4a6c6c1999fcf4c5487882fa09a50","first_seen":"2023-05-10T17:52:44Z","last_seen":"2026-08-18T03:10:36.811506Z","times_seen":257,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/css/bootstrap.css","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.572Z","timestamp":1787022610572,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/css/bootstrap.css HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Dec 2020 23:50:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5fcebfb4-2f1f7\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":193015,"size_decoded":26036,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (560)","md5":"052dfc723bbdf659b1528e37b1472301","sha1":"a06f1b5340a4dceaa9a8e044d0248ab48fcb7e17","sha256":"0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334","sha512":"99a22fd4a93d74eca1883c15ee63799eee662428db0371a26003d14988c9bf8300597835b38637aa2c5961e9dde3b8e67eb371609e2e68e62ddaa62bdd792a97","ssdeep":"1536:Hgwcfq/zc1+QI/Rhi4De5j9p7AC2LdQVUaryWrSPUKO5kIl8d/ALfLNLy:Hpc178d/ALfLNLy","tlshash":"10140f9dfdf118087057956864dbbbf57b7e4086d20ece7a76e23264cf493c18c62a88","first_seen":"2023-04-05T04:36:20Z","last_seen":"2026-08-18T03:10:36.811968Z","times_seen":1257,"resource_available":false,"data":null}},"time_used":535,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":535,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/css/test.css","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.574Z","timestamp":1787022610574,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/css/test.css HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 21 Feb 2024 10:25:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65d5cf7e-91d\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2333,"size_decoded":1339,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"03a9ce69d9097a324d433d1f0ddc3d3a","sha1":"6f6bdc173e191082f54464ce5740819aa8e262ab","sha256":"4769dde8f80f8cea0296811653226b72c46c7a0fa8cf744fbd981e0fa531e2de","sha512":"1319274b81c5dfc2f8a1281dfd1b4ca37af72d071298a9159f967e44714379170c5aa9d08e4553483855100541cc806585b05a85a1a2255327378dec9acea71e","ssdeep":"","tlshash":"a241d0eedd1810087273dd98b3a25e9aab5e0096db074a79bff02054f14661d5270fcc","first_seen":"2024-08-19T22:59:50Z","last_seen":"2026-08-18T03:10:36.812503Z","times_seen":31,"resource_available":false,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.584Z","timestamp":1787022610584,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/js/bootstrap.min.js HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 07 Dec 2020 23:50:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5fcebfb4-f3cb\"\r\nexpires: Tue, 18 Aug 2026 15:10:10 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62411,"size_decoded":16723,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (62126)","md5":"cabc5d07dec4c381f521bbcd41c009db","sha1":"ca329d086682a4d75b5528d326a66a6d3fffab13","sha256":"2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9","sha512":"66f6e36c99f2b57f526b4dff01c6cffe787d2bde6d6abe11d080314d2da08760a18889de7ebd6bec4a675429694d650437b55aaef12c1f7aaebe463587474016","ssdeep":"768:+hkw5E0MWirtTVU4t8GMqm7MT8VbdPyqzgqqqLWpeki3iMFpnkIID0Jhp6zvsv1z:+Z2TTktMqTiaDkIxIzcn","tlshash":"ef538249b254787206df747a817b460bb73a2899a046813cb97ad8dd1f7cc893173fb8","first_seen":"2023-03-07T01:02:38Z","last_seen":"2026-08-18T03:10:36.813035Z","times_seen":2553,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/mukta/v17/iJWKBXyXfDDVXbnBrXw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:11.280Z","timestamp":1787022611280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/mukta/v17/iJWKBXyXfDDVXbnBrXw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://162.89.74.97.host.secureserver.net\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 20480\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 12 Aug 2026 13:12:06 GMT\r\nexpires: Thu, 12 Aug 2027 13:12:06 GMT\r\ncache-control: public, max-age=31536000\r\nage: 482285\r\nlast-modified: Mon, 08 Sep 2025 18:10:40 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20480,"size_decoded":21293,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20480, version 1.0","md5":"5fd54c8638ba894fdcdb77dc6ac4a243","sha1":"bef5c820b46979a18ba459f94ac6ac4bc782b910","sha256":"510168c767781af2e91c8c62b29baef5673b3b00445e9ab97fc2d0cdc99fd8c3","sha512":"7ec7da9fcb2496550d2c9d3331ae3d8dc20482370ed3c6478112c058341de0a3a954058c7c8f56acbb9b4e166fb7fd1992c928eba54ba5ed58e7e6819b9c4b74","ssdeep":"384:0kp8SJ6QoC7m1Lu6nDTJbUMW9Oohs/GbLAdtPUiMgGELyn5dQi:uScQbifvJboOIcnUhgnU5Oi","tlshash":"4392e0fa76a016c4e0cc1bf9d061d5b5d4a8dea4d3102d4c23a4ce3d9e45fe6707798a","first_seen":"2024-11-10T07:53:47.902253Z","last_seen":"2026-08-18T06:07:18.133151Z","times_seen":1259,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":0,"dns":4,"connect":30,"send":0,"wait":18,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"url1924.medicardmalta.com/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D","fqdn":"url1924.medicardmalta.com","domain":"medicardmalta.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:05.098Z","timestamp":1787022605098,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D HTTP/1.1\r\nHost: url1924.medicardmalta.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"url1924.medicardmalta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"url1924.medicardmalta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"url1924.medicardmalta.com/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D","fqdn":"url1924.medicardmalta.com","domain":"medicardmalta.com","tld":"com"},"ip":{"addr":"3.79.130.38","port":80,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:05.354Z","timestamp":1787022605354,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D HTTP/1.1\r\nHost: url1924.medicardmalta.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 18 Aug 2026 03:10:05 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 90\r\nConnection: keep-alive\r\nLocation: http://nuan.boombeachx.cn/wp-includes/rest-api/dq1uzka/unsubscribe/\r\nX-Robots-Tag: noindex, nofollow\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":17,"connect":25,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"url1924.medicardmalta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"url1924.medicardmalta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-18T03:10:09.938Z","timestamp":1787022609938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/ HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=950dfda62b137ebaf6e052be542df212; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"950dfda62b137ebaf6e052be542df212","quoted":false,"path":"/","raw_expires":"","max_age":0,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=950dfda62b137ebaf6e052be542df212; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":2594,"size_decoded":1500,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c9dde231923deeadbc8f199f89fdc793","sha1":"50f168cbe1f1a37a5cf2a10b8ed06fa80924fa19","sha256":"ac353dd716195dda451ec6d9ddb35cd99a7b81b872988e5cc88d219fd56551ce","sha512":"b04c65574fd8183fbed355f04c18a9aebcbeb02cd8f043150a3c19b2e260c72dabc65f2f6dfab896a3b1d2129a39445604de8db7529a8b62d747843e7a541408","ssdeep":"","tlshash":"f2511034dcf4842b615144b43e72ac8f5ee2e60bd65e9a8570ec96901fc2f8acca758c","first_seen":"2024-08-19T22:59:50Z","last_seen":"2026-08-18T03:10:36.813984Z","times_seen":28,"resource_available":true,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/js/all.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.578Z","timestamp":1787022610578,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.0.0/js/all.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 447131\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 07 Feb 2022 21:01:39 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y8rs3S0SJnD7w8oWyX8bAffP%2Fw3YOQS2OO89sn1vbOvc1j3rnwOoa1kK2cdnZ9kF3GlF%2BItGgO49h7BWo2%2FV2eVYhBaHDxtKLE3sDi8c4sD2AckXswS5zAV0o27GoVwOZkHm0klt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a2cdb9543e834e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1464905,"size_decoded":448137,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65317)","md5":"cc00e694fc491cf03655f43eb83ab9bd","sha1":"5b3b17c5b355f473ab89b42545410c51ad51bf58","sha256":"f8a3bacb8d21a5c19437a8b1573b59e6c1850bf37efd0d1a13418d41f917ff3d","sha512":"fa590d5a18270ca6760b74b418a9ccb7d7ff76e3271c202d9fd564bd6985c77b6e9c5d95164824e04a339597b5e84deb3906fdbc5f7d7fcb7bfeaa48eab6e6b4","ssdeep":"6144:+ZmgvFsUIY0mRrSWAept/X8Xt6kXTfyGmlvWyHs:4qUD0JPvgG","tlshash":"d425a46cd7a093fc5d6a83f58e2040b47d8f55ee7690a33cd2a9c670b1624ecd5c8c9a","first_seen":"2025-07-31T22:20:51.99194Z","last_seen":"2026-08-18T03:10:36.814525Z","times_seen":467,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":3,"connect":12,"send":0,"wait":83,"receive":358,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/image/logo.svg","fqdn":"162.89.74.97.host.secureserver.net","domain":"secureserver.net","tld":"net"},"ip":{"addr":"97.74.89.162","port":443,"asn":26496,"as":"AS-26496-GO-DADDY-COM-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:10.592Z","timestamp":1787022610592,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"162.89.74.97.host.secureserver.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 12:31:31 GMT","end":"Wed, 28 Oct 2026 12:31:30 GMT"},"fingerprint":{"sha1":"87:1A:05:15:B4:17:48:B4:BA:9E:44:1E:14:8A:BF:2A:F7:29:FB:8B","sha256":"0D:9E:4B:9C:62:DF:46:16:24:AD:B2:1C:8E:8F:6A:23:BB:8F:79:A4:3D:6B:FC:FA:68:52:AC:D8:B6:14:E8:C7"}}},"request":{"raw":"GET /scl.swisscom-kundenservice/CH-DE/image/logo.svg HTTP/1.1\r\nHost: 162.89.74.97.host.secureserver.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/\r\nCookie: PHPSESSID=950dfda62b137ebaf6e052be542df212\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 18 Aug 2026 03:10:10 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 21 Feb 2024 00:10:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65d53f68-1813\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6163,"size_decoded":3033,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"38be0de766af1aaa475f946c32b47944","sha1":"646ff2fae3c8080da7c067e6506f1a1193b9cfc8","sha256":"330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4","sha512":"20feebf7e0888ac048f0fbcd8c09c748df432ed946460c886dcdf89b49da98cc9a2af35116b3b28a0f30a1c0d3cae36856d2719dca35f97693aa2fa310c56bb2","ssdeep":"192:9D/pNzACPyEwZ+p5M3TFITYJxSWRRZblnPpl8FL:RpNzACPpK+v+OYJxSWRbblnPpGFL","tlshash":"e0d14fc7a314d3ade9c5d21def62d854a20f60fbf4a6c6c1999fcf4c5487882fa09a50","first_seen":"2023-05-10T17:52:44Z","last_seen":"2026-08-18T03:10:36.811506Z","times_seen":257,"resource_available":false,"data":null}},"time_used":1049,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1049,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-18","alert":"Phishing Block","trigger":"162.89.74.97.host.secureserver.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-18","alert":"Sinkholed","trigger":"162.89.74.97.host.secureserver.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Swisscom","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Swisscom phishing","tags":["swisscom","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Mukta:wght@200;300;400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/","date":"2026-08-18T03:10:11.130Z","timestamp":1787022611130,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:53 GMT","end":"Wed, 28 Oct 2026 20:43:52 GMT"},"fingerprint":{"sha1":"91:24:44:08:3E:65:60:72:3B:18:06:E2:82:7E:C0:8F:97:46:5D:B2","sha256":"71:59:B7:BB:3B:E8:E0:81:C8:B6:24:A3:57:11:62:47:10:A1:3D:E4:38:30:54:27:2E:19:C8:96:02:25:52:DD"}}},"request":{"raw":"GET /css2?family=Mukta:wght@200;300;400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://162.89.74.97.host.secureserver.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 18 Aug 2026 03:10:11 GMT\r\ndate: Tue, 18 Aug 2026 03:10:11 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8262,"size_decoded":1288,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9bb1f420562d6273f53c110b466f2ccb","sha1":"06e072ad03707b118b11ac0071fbca741293aa1c","sha256":"8c61a48dd337fa2b8f7b06be0e30de0da26c4932fcd191b4836cab0e35c18212","sha512":"45f083ec67e5f3996d69d9caaa13d67f7724049fac517bdde8ca3d5c31a718d5865fc1ea84d3e949743379cdd5c2865af7555a388615f94beb7a1cca961ac419","ssdeep":"96:DO6aSO6aJJc+uVO6asNmO1aIO1avJc+uVO1aaNmOEagOEaZJc+uVOEamNmOXaGOc:6/pDhur82vZRpiFiiU+/e9U4tm6tO","tlshash":"6102fd9004a7a400ff972cc122cebe22de5e72546054d5b9affe18c8addfc2a1391b5d","first_seen":"2025-09-18T00:06:54.432203Z","last_seen":"2026-08-18T03:10:36.814986Z","times_seen":208,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":3,"connect":15,"send":0,"wait":33,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}