{"report_id":"cbc1f99e-fb14-46aa-8f31-e768380f95f2","version":0,"status":"done","tags":[],"date":"2026-10-04T06:05:28Z","url":{"schema":"http","addr":"promo-sbb.com/","fqdn":"promo-sbb.com","domain":"promo-sbb.com","tld":"com"},"ip":{"addr":"196.251.122.24","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"promo-sbb.com/","fqdn":"promo-sbb.com","domain":"promo-sbb.com","tld":"com"},"title":"Das Online-Portal der SBB für Fahrplan, Zug und ÖV","dom":{"size":748575,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"e457dfb20613c3ddfe5c78a3059617f4","sha1":"1ff27ce10f2324e8f0ff193192de42e0b0186c08","sha256":"0298423be50ac4730599f2234d13dc23dd29aca4d80d5135830cd1ddee8b5083","sha512":"649583652a6f45491a4e9b44d206e7129275ef49f2993e79d3fd5b2647ec712b8b6ad0095309942cf7c891f84334d829e3ba006ce837507225da703e6b1ee569","ssdeep":"12288:0gb8HOOGdR1l8q0XHQ3ppSoX49rTmE/vrmyMFTt/uK:DEOOGdREfHQ3Zqwt/3","tlshash":"2df4d092f520d63a1937392d42eaa7ac6d116f4eff019bd4b143c11627cabf6089371b","dom_hash":"domhash6ebbdb2bdc2ce3b10ef937c4ac3ace21","first_seen":"2026-10-03T16:57:26.749446Z","last_seen":"2026-10-04T06:05:30.437759Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"promo-sbb.com/","fqdn":"promo-sbb.com","domain":"promo-sbb.com","tld":"com"},"ip":{"addr":"196.251.122.24","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-08T06:05:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-04","alert":"Phishing Block","trigger":"promo-sbb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"promo-sbb.com","ip":{"addr":"196.251.122.24","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"domain_registered":"2026-09-29","domain_rank":0,"first_seen":"2026-10-03T16:57:22.687117Z","last_seen":"2026-10-03T16:57:22.687117Z","alert_count":6,"request_count":1,"received_data":12366684,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"promo-sbb.com/","fqdn":"promo-sbb.com","domain":"promo-sbb.com","tld":"com"},"ip":{"addr":"196.251.122.24","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"23aee925b1ce3b13f455fe2e8d8aa3e9","sha1":"02a9e77e50afc2713961fc4af8df323f73b00609","sha256":"ac8fa61daef264e307f8de0ca96d65c09b9452ecf0fbeb3e3928cf46fd8c5bdc","sha512":"8d8ce45b3b4b1f57c97d4184a6801b34bafb58267da9711f7f7091f0f4274a0a556edfda71c27b414aae1e905b43475eca854fe75b380b0a97f6d5595a3fd3ac","ssdeep":"96:I2Y7RQXCwONqeN2EHZUqATfiTXAFvSeK/X+JV9R4OaSTVkGSr0yErElOG5rDvjWk:I28RRqeUE5/UiX+HD4Oa0rczvchahLMI","tlshash":"a9f1a694e5822c7115b710ab2aeb6285713981a30801fa403f6cd54c2fac92f53bff6f","size":7729,"data":"","first_seen":"2026-10-03T16:57:26.755609Z","last_seen":"2026-10-04T06:05:30.440657Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"promo-sbb.com/","fqdn":"promo-sbb.com","domain":"promo-sbb.com","tld":"com"},"ip":{"addr":"196.251.122.24","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-04T06:04:53.951Z","timestamp":1791093893951,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promo-sbb.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 17:33:49 GMT","end":"Mon, 28 Dec 2026 17:33:48 GMT"},"fingerprint":{"sha1":"5B:3A:AA:58:6E:38:4D:D3:C5:7C:3F:D3:8A:7F:B5:CA:A3:B5:4C:9E","sha256":"9A:2E:38:AE:DA:43:9D:11:67:AA:5C:C1:E1:D3:A3:80:05:B2:26:FD:51:D5:D3:DE:CD:49:CA:16:51:4F:AA:CA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: promo-sbb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 04 Oct 2026 06:04:54 GMT\r\nContent-Type: text/html\r\nLast-Modified: Wed, 30 Sep 2026 18:11:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6abd50ca-bcb257\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12366423,"size_decoded":9052001,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"d8d5affbb939cb1942c54ac10ae9b613","sha1":"9cbcb3be9c2118d03141d634a8d1affd48298268","sha256":"cc21440c1ea9b90bd7a2c1f1489370748437b68a87ea70f10672d3e1a7217af9","sha512":"d6fc848fa06144208ecf0605abeabd422ffc10248c3f338dbc62139857b1f249df0ba7e5984e8d9a3790d260e7541c3b5309d24ec8406bc2117494a7d5ac596a","ssdeep":"12288:5gblHOOGdR1l8q0XHQ3//HKkQQ+hqp2266nm/cbHFc35pH5ag:ahOOGdREfHQ36FQ+Ik5p/c7+F9","tlshash":"a3259c91f540e63d59377929878fa66c9e246a4dff004be4f043c80927cabfa1a4b717","first_seen":"2026-10-03T16:57:26.754399Z","last_seen":"2026-10-04T06:05:30.439215Z","times_seen":2,"resource_available":true,"data":null}},"time_used":547,"timings":{"blocked":0,"dns":4,"connect":29,"send":0,"wait":59,"receive":386,"ssl":68},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-04","alert":"Phishing Block","trigger":"promo-sbb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"promo-sbb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}