{"report_id":"cb82078a-226d-47c8-85fe-75ec27cfabfe","version":0,"status":"done","tags":[],"date":"2026-09-12T14:31:06Z","url":{"schema":"http","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":0,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"title":"Mobile.de Händler-Login","dom":{"size":25229,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7459)","md5":"8d2cf36513b910916df7299650422d29","sha1":"2d8719baa6f573beccb4e1dd2d2c8285ee11df1b","sha256":"92221f1043c0aca05cc1d97b42856155727c773f24e95c4cd89f0e2e59d2d43c","sha512":"b500bd25fa05b208950b818a1c976874c5b91940603cc533dfd4a089511ed556732af0ab2506c6c8691a752ad362d0f38a05af37fb22dc939cc7d496c3abecb4","ssdeep":"384:Zv181ky0Vl6nDuLE9PzCa58axKnvKKt1amRTru8wgY:DQkyVDuLElEaCCKt1amRTrubgY","tlshash":"6cb209f4eaf4527ab75f8379e2b9a81d2209d067ca415f08f27c435c5bc6ac48c92b4c","dom_hash":"domhashebed7ac1c68a01540167b801476f470e","first_seen":"2026-09-12T14:31:09.232455Z","last_seen":"2026-09-12T14:31:09.232455Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":0,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-17T14:31:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"niels-meyer.de","ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-02T12:19:48.666524Z","last_seen":"2026-09-11T07:45:56.590902Z","alert_count":14,"request_count":7,"received_data":4514054,"sent_data":4543,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/style.css","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","date":"2026-09-12T14:30:36.412Z","timestamp":1789223436412,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/style.css HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 08 May 2026 08:26:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69fd9e1c-20cd72\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2149746,"size_decoded":793630,"mime_type":"text/css","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"039ec9c6f69e2953096823a014221955","sha1":"597e602d1d4fe9c3895f2d3ae566d0ff91175305","sha256":"42e53756043d0df31fe34aa0e28a7906696c672ad99515fde0ae0fd64c5afa2e","sha512":"ca662fe946a553ec22f9c956a408c968638b9a237e03b1686a1ea318fe4e7139fb5d8a7c7312f34f479b5ea735911c8aa89fdcf3cf4139c83d7cdc42fb3e7e94","ssdeep":"24576:RSoW0m7xSoW0m752hvH9z9usHEnycsmcfxR:E7k75Ovjv","tlshash":"bd252970f911f8f71bbb253a2b88a94a6db8ac438914578dfec5606c1dce3fb89d5404","first_seen":"2026-09-12T00:52:42.675851Z","last_seen":"2026-09-12T14:31:09.234518Z","times_seen":4,"resource_available":false,"data":null}},"time_used":408,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":408,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com#","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","date":"2026-09-12T14:30:36.414Z","timestamp":1789223436414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 11347\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25231,"size_decoded":11579,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7459)","md5":"c95ae48595ab07ccacbe32d498cede19","sha1":"54b6a862f621ebe2db91d676c992584490de5ff0","sha256":"d4c4396e0a33716a221a0d756f9a4ce4cbe06a68a3c4a41ca40aafc12ed26659","sha512":"b4f5ba6a71613cad1b91e3e45003708f85404bf453539dc53df819d094911d613903893672e8b8df46330cc513a3a4b3ce83cd205135db6d8e70b9f4564fcd6b","ssdeep":"384:Fv681ky0Vl6nDuLE9PzCa58ax7nuKKt1amRTru8wgK:YQkyVDuLElEaJLKt1amRTrubgK","tlshash":"edb209f4eaf4527ab75f9379e2b9a81d2209d067ca415f08f27c435c5bc6ac48c92b4c","first_seen":"2026-09-12T14:31:09.23592Z","last_seen":"2026-09-12T14:31:09.23592Z","times_seen":1,"resource_available":false,"data":null}},"time_used":827,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":713,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/default-marketing-image-de.png","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com#","date":"2026-09-12T14:30:36.535Z","timestamp":1789223436535,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/default-marketing-image-de.png HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 11 May 2026 08:27:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a019306-11863b\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1148475,"size_decoded":1149104,"mime_type":"image/png","magic":"PNG image data, 960 x 1010, 8-bit/color RGBA, non-interlaced","md5":"42e1312ee857e616b4024dbe1ed7887a","sha1":"82ac5da33a357baaa2733d30904b0425512682a3","sha256":"97db203f03d25280d4e135457d30d4230c0e3c94d6854f5a9d2971ce155b9993","sha512":"92afe8ecdaeecbadcd056e4120c64794b7685bbfc14b633375b28b1fb6db66cdd59c39a21c8fa4e3903767f7577e5e34e880f350e25bf45703bb4ae0fe24dbd3","ssdeep":"24576:GagkaEJK/PYf9VxHvgM/Vz9g0PQYaCdIQJTSXbYYc2gL5Ij3Uq:GtrAK/g7dvgOVpg0QKZJTXY69Ij35","tlshash":"2c25337473e6669e85fa28e2d882ccb4cd3d69ea56ac5f88b24c4146630d12cb5ccf85","first_seen":"2025-07-27T17:36:15.339311Z","last_seen":"2026-09-12T14:31:09.237588Z","times_seen":22,"resource_available":false,"data":null}},"time_used":706,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":706,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/favicon.ico","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","date":"2026-09-12T14:30:36.632Z","timestamp":1789223436632,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/favicon.ico HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 15086\r\nlast-modified: Mon, 11 May 2026 08:28:14 GMT\r\netag: \"6a01931e-3aee\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":15086,"size_decoded":15351,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"5d289590a337d80de43bcc19719a01d4","sha1":"a03772561ac5d4b8c32579930f2691ac28583a37","sha256":"881536f403a4818022650d032668a10d01744aba24c717c03083b85ebb6dea8a","sha512":"e6d35d01443e37d79c38a6540d423d6b87d71848bedd945fcf658dd287fa0c74d9653c8b9a516d5e751d054ec5b135a083fe0ffc0af0f734d4085a618b90f37d","ssdeep":"192:jGrtmzeJ9rLonpTw8hx7uNt2X3ntXeAs4:j0F","tlshash":"7d6253f6128fb51af11a94791c8f296a670dac01d45a34cb2d8bbf4c353c5d72839b83","first_seen":"2025-07-27T17:36:15.353565Z","last_seen":"2026-09-12T14:31:09.238951Z","times_seen":46,"resource_available":false,"data":null}},"time_used":633,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":608,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/default-marketing-image-de.png","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","date":"2026-09-12T14:30:36.420Z","timestamp":1789223436420,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/data/default-marketing-image-de.png HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 11 May 2026 08:27:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a019306-11863b\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1148475,"size_decoded":1149104,"mime_type":"image/png","magic":"PNG image data, 960 x 1010, 8-bit/color RGBA, non-interlaced","md5":"42e1312ee857e616b4024dbe1ed7887a","sha1":"82ac5da33a357baaa2733d30904b0425512682a3","sha256":"97db203f03d25280d4e135457d30d4230c0e3c94d6854f5a9d2971ce155b9993","sha512":"92afe8ecdaeecbadcd056e4120c64794b7685bbfc14b633375b28b1fb6db66cdd59c39a21c8fa4e3903767f7577e5e34e880f350e25bf45703bb4ae0fe24dbd3","ssdeep":"24576:GagkaEJK/PYf9VxHvgM/Vz9g0PQYaCdIQJTSXbYYc2gL5Ij3Uq:GtrAK/g7dvgOVpg0QKZJTXY69Ij35","tlshash":"2c25337473e6669e85fa28e2d882ccb4cd3d69ea56ac5f88b24c4146630d12cb5ccf85","first_seen":"2025-07-27T17:36:15.339311Z","last_seen":"2026-09-12T14:31:09.237588Z","times_seen":22,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-12T14:30:35.649Z","timestamp":1789223435649,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:35 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 440\r\nlocation: https://niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T10:24:28.258643Z","times_seen":18440847,"resource_available":true,"data":null}},"time_used":356,"timings":{"blocked":-1,"dns":34,"connect":25,"send":0,"wait":128,"receive":0,"ssl":168},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"niels-meyer.de/kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com","fqdn":"niels-meyer.de","domain":"niels-meyer.de","tld":"de"},"ip":{"addr":"195.242.103.110","port":443,"asn":9211,"as":"Nawork Internet Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-12T14:30:36.013Z","timestamp":1789223436013,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"niels-meyer.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 07:10:30 GMT","end":"Tue, 13 Oct 2026 07:10:29 GMT"},"fingerprint":{"sha1":"31:77:2D:D4:B1:4C:A3:05:06:4D:61:C9:83:99:0E:45:A5:6B:D4:E4","sha256":"73:89:33:BC:71:42:6C:E9:6C:BC:CC:A3:35:32:FC:1B:C8:21:EE:7D:C4:9D:17:E1:18:E1:53:4D:69:74:8C:6D"}}},"request":{"raw":"GET /kebchax/xcin1qe/jqiknbw/id.handel.mobile.de/login/?email=corus8@f8e0c44cb736ef6c379c91446f03128fb38e.com HTTP/1.1\r\nHost: niels-meyer.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 12 Sep 2026 14:30:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 11347\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":25231,"size_decoded":11579,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7459)","md5":"c95ae48595ab07ccacbe32d498cede19","sha1":"54b6a862f621ebe2db91d676c992584490de5ff0","sha256":"d4c4396e0a33716a221a0d756f9a4ce4cbe06a68a3c4a41ca40aafc12ed26659","sha512":"b4f5ba6a71613cad1b91e3e45003708f85404bf453539dc53df819d094911d613903893672e8b8df46330cc513a3a4b3ce83cd205135db6d8e70b9f4564fcd6b","ssdeep":"384:Fv681ky0Vl6nDuLE9PzCa58ax7nuKKt1amRTru8wgK:YQkyVDuLElEaJLKt1amRTrubgK","tlshash":"edb209f4eaf4527ab75f9379e2b9a81d2209d067ca415f08f27c435c5bc6ac48c92b4c","first_seen":"2026-09-12T14:31:09.23592Z","last_seen":"2026-09-12T14:31:09.23592Z","times_seen":1,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":195,"receive":124,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-12","alert":"Phishing Block","trigger":"niels-meyer.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"niels-meyer.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}