{"report_id":"d0132cc1-d422-412d-92d0-b5cd781f9f08","version":6,"status":"done","tags":[],"date":"2026-02-01T19:03:17Z","url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"title":"Postfinance-user-auth: Crypto Casino Games \u0026 Casino Slot Games - Crypto Gambling","dom":{"size":345156,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (29995)","md5":"5d5ba18ec2c9f5a44f2dff597ca6e580","sha1":"1e4959acfd5dfef05017d6bd7ef25c3fbe74a927","sha256":"7032840543822d77f3896caf5bb91a347c818309aa0c5a86d60de16ddb1d30ac","sha512":"ba8bb2dabc29b03b8d7be0cd4692391c450630b401e853a4c4e5eb1b25856f9199ede7840a773bcea169c165894e4a66bd988c5fa5ca44ba3f84096cd81aa8e9","ssdeep":"3072:RstJkaBYI7ZAN04R9yokSo/7nTAVm2tgiiD6M/2yT+VvzrhJUo/i2/8GtN/:REfB5sIQTR","tlshash":"68740929e402da69e4274ded317eaf7a918ed637ca63896cf3dcc4a403868358f915c0","dom_hash":"domhashe25cb88ddd2380b94c18dcb83a30608b","first_seen":"2026-02-01T19:03:24.017534Z","last_seen":"2026-02-01T19:03:24.017534Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T19:03:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"postfinance-user-auth.com","ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-02-25","domain_rank":0,"first_seen":"2025-11-23T22:59:38.065448Z","last_seen":"2026-01-31T21:17:15.170132Z","alert_count":621,"request_count":207,"received_data":9492867,"sent_data":180816,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b10f9b9006411b6afcb5843e7c57c31d","sha1":"a7731eccb8b59abe9c0743003d304b3453e69938","sha256":"30cd123786f0b612a543aebae24a5dd7ac167190d35ec78e66c949a4ce868f44","sha512":"e5f863b39ab02a5072a1c5087569aac9fd79ead2888c61dd36312cb32910bc428a2aeb691f194bd3444c3ff6c6e146b26689ec519b06c2100864149bcafb8671","ssdeep":"","tlshash":"6ff081f47452f9a7c5a23424013b7f17176f110e75089810d71fd154573aa3b8393a8e","size":573,"data":"","first_seen":"2026-01-31T21:08:57.386599Z","last_seen":"2026-04-28T01:10:54.359165Z","times_seen":182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"10d8b01b1b865a519be7d5b88e98bcac","sha1":"80cc14de2c8bb984866e74720f37ad57a80e9acf","sha256":"ce33f60576204820a75cd31723620bd7247276841db0647fb820abea4c8ab03d","sha512":"cf9a2f01ddc7113f81551041381a6e81350c9febe4b7f24f2143df7177c5bdf87a4cc5ef95a5a14ab06aeab4a710635b1e8c60e816eeeebe0766eeaa643d7208","ssdeep":"","tlshash":"f0f00e358b3c10220aec08f9c0898be83e2d7262e0245060fc69de7d0948cafd053eef","size":525,"data":"","first_seen":"2025-07-20T14:54:50.990021Z","last_seen":"2026-08-07T12:32:07.991983Z","times_seen":4783,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c3e3e350f78cf22bd7b335d70b41a58a","sha1":"cce22220b6a8dff76692755cc45439b4ec474a4d","sha256":"ee6bb81f4e9fc030a39a7c71affc4d1f2b900baa4b4c7af83361388d7c39599b","sha512":"15b6cbf8bd67e82a4952004138ebc95c44e4d373317826f1560eeec13416cc1d6a38d834609ef4b713e7a9c92d1b1bbf84de08e2e4061ed3d1e3891982c25b0a","ssdeep":"","tlshash":"3f90025ff2302063a756122b166f15456421626565550869123830eb4955148474265c","size":57,"data":"","first_seen":"2025-06-30T14:23:19.448274Z","last_seen":"2026-08-07T13:59:30.951452Z","times_seen":66159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/turbopack-8b7cbc757f5a124b.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bcd0b1d5248ea7beca980ad82efa6807","sha1":"ff3d78d01c42f6bcb8afa64500820e3b31dd94dc","sha256":"10f69d74fdef4854f791540887c3c947f1f50bcee1a89db478554eb66e9ced61","sha512":"84019404a81099de2ee1ba054b0603f518f19e56e97bd2d5b208acaf96af0f271d4f5a4a7f1efb9f2d63af2c42a81720283872f3a17486466c0b735848a34dd4","ssdeep":"192:3spVl08YEsUnUj5E4dn2Npl/daXMh6lW9xocxkUk1MsOR:3spVv40bl/A1UroQp","tlshash":"6322b4da33a6f073436fa1e6807f0044f17944b9145d582893aca8fa28394ae49e7f67","size":10680,"data":"","first_seen":"2026-01-31T21:08:57.353463Z","last_seen":"2026-02-01T19:38:23.504412Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"00933d3d76fccf8f1d330b001b6dc118","sha1":"72a3f9f693a7d05bb6f1b38fd381a0f4e8bb5c7a","sha256":"4009527b06902e2fcd3c2ce78c0652caf43bda1783d1577198d0c3919782c607","sha512":"8fce1ced1efcaf7f17f0fbc71664f0ca59f5f7bddc682fdbc8b9ef3862def740a845bc3cd5cc3926c09b98782296d14c9b38d50b2dd6cb53b296ec76ba558602","ssdeep":"","tlshash":"090156a9f328199a66d92fbfa06a570c7460603e380600319507edfa1700de021cbd8e","size":845,"data":"","first_seen":"2025-08-20T23:30:20.291724Z","last_seen":"2026-08-07T13:59:30.952369Z","times_seen":50671,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1a6e1178e4bbf5730bd664a49dd3bc24","sha1":"17c3ae3273f9de6afbbdedf2e413dbb3a6722792","sha256":"3814cddd18b2095e01abb745a99e5ada90178e709c09879324c3b623f2d829ea","sha512":"cfb1aab0bf589e33fd12906f448ddbbf7163420a088de513b174304c9ba3a7abcd9b41c98bc4dd51edd0206c1fe4660db9857e3c6163d1bf50c670cefddee509","ssdeep":"","tlshash":"de9002b090c39c5890264186687100160b6c040c01080141132184d810115048e40d8e","size":43,"data":"","first_seen":"2023-03-13T01:07:12Z","last_seen":"2026-08-07T14:06:09.101192Z","times_seen":216886,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/be7248fa84c6d551.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"598a7c75a166616da34d0720a50b9cf3","sha1":"35eccbe396ae1d530fb0174811f94c4a35dd1c10","sha256":"99be381c3d3f98808a540d62ec9cb7fe1797ff9e3588e5078a26d52374152fa7","sha512":"5ee7366a017183c0a2049c1735a9135a139e62ed6411726d18b9edce9ce57e7d27bf5fe1b8ce6f915773d1d20e0c0a9cfa9ee383dda62d3a65043daafe744328","ssdeep":"","tlshash":"5651a5413444b164353629a8a0bf000e766e1b75834cbe3296fd74fd262189cdb676ef","size":2515,"data":"","first_seen":"2026-01-31T21:08:57.246674Z","last_seen":"2026-04-28T01:10:54.169753Z","times_seen":182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/web-vitals.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"aa1e3521e57a40ad394b049fa7ff3bc5","sha1":"ec88012f680be684d8d430c5efd61fc29b658374","sha256":"b17014672e5f28d0dc0cad40ee4d09feb6a1201dadb3932b1f3073a8e4f387d6","sha512":"729c7ed37f0f321fd1c588aab554f289ff37fce9a3cb7dfa78cb8f47db8cbacb69eb0660ea2e245a540dca857f4cf277f67f53c7d789609006e56799ce3ad282","ssdeep":"96:tzI8C48z+TJzq4L88kTAFKb5rbCKHDuqqUtl0AcJ4c0jU4mzWuCD/ZDZkRlulDsd:VC4F4Sk8FKvae0f4TcWuEZDyCSXEdij","tlshash":"eed1d9f59f41e53921bae2b6d47a514333396386a409409ce23eefd0146d4c6739bb32","size":6599,"data":"","first_seen":"2026-01-29T18:42:31.973098Z","last_seen":"2026-07-15T13:28:32.224646Z","times_seen":3490,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/699d240ba76ab6e7.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb3634cf9dbe461ce7b21964ef674642","sha1":"5be5159bc385567dce6e3ac8a821c4628079c72b","sha256":"4ef0b88dfe9e08a67e8361b199e7c5c0267fb4b0ec83ade00c6ca9d55f131d58","sha512":"a512adef8a10ff7d93d6fee4920da94225ddc9f03872b0b2d991ba8ed14cb6b136ebc6382dd9924f7a1c84f8b6a98ecba6dea9e484f774878da9fd576d27336d","ssdeep":"384:CeEJQfhNlOuEi1z9J9TvpiIuy7A7QKGwpRCSNBcAoU8bs541hAblbH36AxVeNyYi:CSN6y8QKGwamoUh541U9XarEqM3","tlshash":"8a03e9c5b320606243d651a384b50203f329a999540a455cbb7ceeffa97cec971f6f72","size":40939,"data":"","first_seen":"2026-01-11T01:55:53.435896Z","last_seen":"2026-02-19T17:02:28.60695Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"95fa3942230da52eea85aa98acd43c97","sha1":"3d533cb5b7db33eadd80836d3d43c9189ff6d3e0","sha256":"51486445f6afe27ced0ba0a7243ba591bca8c0139c00a397f7017f7c922575a2","sha512":"e9b618c4e4267b5111b8cf6dd75c06477b08323c255a8c7ea25bfeb0b3a24cb30881dffcc18b06d2ac631dfa45cb04f9ad631e0197fb85c25cf2576877386797","ssdeep":"","tlshash":"59411d54f40ef9b16852de0f223a4e3584c49ef9d271d588f38dcad642c35ba439968b","size":2291,"data":"","first_seen":"2026-01-31T21:08:57.389508Z","last_seen":"2026-02-02T22:33:10.222291Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"644fa852f565a5be4e5d73b99942ba19","sha1":"86dd97ab00fb36d64f22fbec687e67b5e06937d1","sha256":"6d572310d77b75377c41b25a6a09fc66be4d30ad04b697b1e535b325d65d4696","sha512":"51a21302e16a8196181f11b7b68d459540c58579d26842e6c0c6d150cd15868db72aed0fb123ad8a926c0543ed5eb680d6276f72b83afe0348521c59300d2794","ssdeep":"96:Ll76kMyEYXSYWNYhs/sB5k0RZx20WbWVCydv76kMyEYXSYhHwV:guSyAaQV","tlshash":"99b1be3d2001df4eedab2e58517d8c3e258dc97b9766ceb8c1d8cd315a8a07867d69c0","size":5299,"data":"","first_seen":"2026-01-31T21:17:17.994393Z","last_seen":"2026-02-01T19:03:24.236348Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/d9025b4f6a92ee7a.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a659a4b0e579811bc5023929ba4844ab","sha1":"d22f81bf0900edcbd60abf802263d8ec80c8f5ca","sha256":"912749bf60af5412f1089a97b3ab5bd639378d17917765c0b01537e8cc49a753","sha512":"4916005e5e2a0b57b360240aecdc5909c87c486e19a985f79ba95011c4cfb1bea15601a4944e22754114b24ba7cfbaec9867fdf3126f28dbf91aba0abdba790e","ssdeep":"","tlshash":"044154e1b671563b23b8059cf2359712b7a7883b810e05b0f15e882d19ec8d9929fb86","size":2350,"data":"","first_seen":"2025-11-23T22:59:50.452286Z","last_seen":"2026-05-03T15:31:16.590641Z","times_seen":189,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/dead-clicks-autocapture.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc981e3687edce8a3d22380972ee45e3","sha1":"1955fa562b42c9f134b62e7ac0e9c11bbfa4da75","sha256":"a40d91c2014cca52defeb2481998498f02fc53526fd05302df0e0e490173814a","sha512":"2dc021b1b3ef375290f2d59d97ccc6bd6306aa4af2791c6cc29a129b50acc89a0566e5b27074037312082f55966c0bda2d77ab2ace32ad4a2154d08176e1c2c1","ssdeep":"384:sw+VM/tkSeCRi2WzHiAOjCQBgxjOJWgikn26FT:n+D9QeOMgM6FT","tlshash":"69420a88b7d0f3b12bd7145ac4bf1702f03525082556c824b159ecdab4adb1622bbe7f","size":13059,"data":"","first_seen":"2026-01-12T11:07:28.642714Z","last_seen":"2026-07-19T05:49:44.303002Z","times_seen":5178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/84514c7510b6b9ca.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d51af061e259b2aac980c62c2a581cfa","sha1":"25dc5232dd34515d64d445c772aa386d15a843bc","sha256":"a058a237f6dbe04d72f900d5ac0cd02aa6c68aad91ecdfe74aeb81a7c23b3e3d","sha512":"b9977395310e5f15dcb8b94e1034cff5d09ec28908599e6d68a3fdb453b3d9c805e3eacfd9b42d7a1e156027d445600a5c38c8d5f350f92a79494aef77e1bc30","ssdeep":"384:RqybOz+GjHeaCgyP340BAg9p/cZNRAUL0YvK6dD:Rqyaz+mlCgao0BHl4RAULBC6J","tlshash":"ab62f9e972e6fda383a74194843b0007f6280d76145ea4e4f7e8dcea356094e91f2f99","size":15764,"data":"","first_seen":"2026-01-31T21:08:57.197191Z","last_seen":"2026-04-28T01:10:54.101669Z","times_seen":182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/def7cbf195df9f5a.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"05b7a5854795f3b16ddd353eca16e154","sha1":"89f6babde44efc57c9bd0634ea262ff955ca8f4f","sha256":"5fe9c07dc3c71dda87fbeae79cbb1ac4db42eac6b05d0dc562b9d895acc64012","sha512":"81ed9e8713bb64bb1ed9ee389db51f4cf7f1d4231cf644658556258026e3503fd798fa8b0063dae4af7ff63ec49d8bb45320bd6a49e156bc2602c96ae8f44174","ssdeep":"","tlshash":"d61121887752e0eb5be329dc183f088be0e155b4582db8b147e565f220f8fdd867da20","size":1000,"data":"","first_seen":"2026-02-01T19:03:24.238335Z","last_seen":"2026-02-02T18:32:16.61703Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/19b0da46175198e4.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2007ebf0b401ba67c261030cfee8e756","sha1":"e38591bbe7d137269496a20c91da35ea00581c71","sha256":"e49adb5040e39e1241fb0ec7756630b4a0bbca6dc3cb4a82abb2c15772c1b528","sha512":"7768dae710c0e0a546c9502c8b1f5e49cde8ecd56541cf9dc726ffb8f694d4f5ed2ef5e5a27e26da06936686bb3f571f39fd2c81d85589f00808cf11c3353109","ssdeep":"384:lDxQbCQlLQVt1VmIudAorv8ii9gGTHR42VqzR6l+mgebWgrw1gC:lDxQbCQlYHmIuq9zrRUElHbWgrugC","tlshash":"a5d2d690d121b8b8ac6b89eef57d801d721d1b24c71d0b25b1bb6efc13446c87e53b9a","size":30131,"data":"","first_seen":"2026-01-31T21:08:57.374651Z","last_seen":"2026-02-02T22:33:10.172899Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2870c37277e2b061986ce35bbcefc5d1","sha1":"f37921f74015e08ee0625648ae697de9f4c11a4f","sha256":"d3e1a6cc1c55b4d31e8521c79dfdceba78bec28e85147d89292e00beca6ce9a5","sha512":"1367f9b658ba79e40cc32c66689930097ae53b72e9bcf4167bcd6eb530de9b79d78eb84e75e64d576f44882b6da856c70363e900089d67e20f787dc57e93fc69","ssdeep":"","tlshash":"11513e2d600aed0cd8ab5e5e013d5e3655cdc97ad766ceb8d29cca76424a038a3c78c0","size":2946,"data":"","first_seen":"2026-01-31T21:08:57.391699Z","last_seen":"2026-02-02T22:33:10.224804Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"933682ec098a27832d260e61f8260676","sha1":"0ac5c9c38e3fea3e6d0e130214cdd6d2e5320589","sha256":"ab6f2925bef418c90d646c90bbc67f787cad8a1e24047eb5301154b6efe4c6a0","sha512":"da7fedac24b8f0fd363aa084435d5fb90cb1399fada749a35ffda540be9944d11869570f66389dda6f8c3f0d5e6b2750cb7b00f192f6976ab0559726a73a5898","ssdeep":"","tlshash":"5e51f03c2016da5de9ab2e18117d8c39258ec97a9726ce75c2dcc932554b078a7d35c0","size":3136,"data":"","first_seen":"2026-01-31T21:08:57.39267Z","last_seen":"2026-07-30T14:11:57.020692Z","times_seen":213,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/4b5fc2a2cf150c41.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9a2db0f51ceee4b64dcf2f34b7cc5de1","sha1":"9d13515ac8e3613937c7e41e704ff52760ddf473","sha256":"3e316fdf81283e8d0d6e95f67225560ef3c1c3b33230192de20cd9a9516a75f0","sha512":"80ac75dc3f6084d84660a5bc6fed6ae94440a6018061ed1fd18289c226952ec56b4790a8d42dc197cb5277edb1596fe26baeea78de76d04cb07d3f621a6657ee","ssdeep":"768:PfCxyEdRqNnKG1+g3fA1SjjDrxEBK8mO2V:3GyEdR2KG1FP","tlshash":"78d2b66050457abcf56708a8ba6dc40cb11eae6cc70fcf18b57c7c253c5a9816d96f93","size":29517,"data":"","first_seen":"2026-01-31T21:08:57.196019Z","last_seen":"2026-02-19T17:02:28.856281Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/ad138cba44450f34.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"11ffb96341f3b620a5370514b73e3db9","sha1":"2451d15feffadad588466305f4a236f382f45e70","sha256":"a9efa5c83a5c5075fa40ef7ba4f7d964399f82426d6417889b7c84428f1b96ac","sha512":"8bdf52566b8af67e5482d9927f81970943cfe7386c5f27f4108d7d52c356bff8e9c971ce4dd132d8b5ec63c456b3465abf1bae4cb6a236f9a759ab39c94a734b","ssdeep":"384:wVm7PRyzVJe6cgrziQ+rI0TJOMLr1299HlDitlKQ96Wjzr:wVm7AxcgvSrTJhtcMLr","tlshash":"01d2b97071a096fc6ad344e6b43e400cb1386aa4c96d5561f3ba7cb8ca119c97e77f83","size":30176,"data":"","first_seen":"2026-01-31T21:08:57.360627Z","last_seen":"2026-02-19T17:02:28.728752Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"72d2e1c9d716bb5af58185b181486a42","sha1":"33ee0f6e679c21056733388cb4a16e86fef381d2","sha256":"ee997912b3ee8feafa8139b9afb5bbd174e1a21590fdb80431bb8628ed62de9f","sha512":"5c198a811d069faff872cb150dbd3defc024198aee6690644df9802704c4a3e421670cc5cc5f7782bb532ee40e28d6dd19e59d95919b46f6c8c2d07d663a620e","ssdeep":"","tlshash":"bbf05270b04235e186a2222848373e0216be222774099800f74fe2206f7aa2b439360b","size":485,"data":"","first_seen":"2026-01-31T21:08:57.409414Z","last_seen":"2026-04-28T01:10:54.343399Z","times_seen":155,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/fcdabb53594fa7cf.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc35eefdfb561070a6c3fd395b8b0e06","sha1":"0e99f80f3609455f7a1d0de1e932575bc2931551","sha256":"6df913cdbb4364f61f7eb112cf23d1b40438d47fe337266bbc9c0acefa387e26","sha512":"52c394db82cb28e8d4376c834989de504542e9d324d5df43688f5c03344a4388ec7328597a3396e7cdeeaf4e9384047a52d812771be24361972c3dac98d90cbf","ssdeep":"3072:3LSLiYawBqU4ebR8+K2k5tx9FpWgJlg4P:bSKU4ebR8p5txxdJlgW","tlshash":"18f33aaa33a725334be9829ea4b51200f3365658604e043cfb7c9dd7296888b71f7f75","size":159127,"data":"","first_seen":"2025-12-31T07:43:06.450662Z","last_seen":"2026-04-28T01:10:54.191549Z","times_seen":185,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bbcaa96b6157551a8c8c0c2b7f08e5ec","sha1":"a2e0ce031aabf512cd5ad17b90903c681a131c87","sha256":"2e350167097b057c9810dcc2436e9451c304755a97c6c75f2c15b75a2755b7c1","sha512":"122c0d1a67e85e4b0fe0fe48b89e6c81ff53d76bbb85d9e2445c662659ac9b31223a46a9865093245220758535843460694d81d7f333e62b1fa2ca09a1eae722","ssdeep":"48:LSJtLaXLdAul/+1jCQQ1iSa6WHgOkxpqu8wQDIh0FmrRiEWn2iD6RVLNIcabbW2k:LI8LO0BKuxdWG8heT","tlshash":"a4b14a0ebc19db019d3aac7d023b9f7a44ccce73cb61d969919fcd490a166f21be8841","size":5463,"data":"","first_seen":"2026-01-31T21:08:57.393482Z","last_seen":"2026-02-02T22:33:10.225905Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"fec25bfae45d385fa351dfed85d613ae","sha1":"1948cf25c040432e5d3eaf2caa2101daf182b5ae","sha256":"d267e487102a6c2cbe9fb44cf91fa0e008d7cd182cf666d71d9ab8b14993a559","sha512":"ef9d40c74bb2074d263c98d805e596d293adb613d609bd1ffcf54118ae3f3f604e94d895df7fcb28e959d4f1aa9b49ada30f4f138567bb52656dd1cea0c750e2","ssdeep":"","tlshash":"1131462e7c15df0aec3a7c69003fde7b50cc8abb8254dea981decd150a0a57a27d59c1","size":1720,"data":"","first_seen":"2026-01-31T21:08:57.394345Z","last_seen":"2026-02-02T22:33:10.226452Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc48946414353a508a2e81688dc2256a","sha1":"60b4b3d7a8361dfcd3cc57643430adbb79222f32","sha256":"2f1d469070d877446b7a3eb789f05b5b88ffdd772027f5a721c060966b8f7467","sha512":"f08381bfd86816af3e061586ad25ae232a4a0054421f7a2a91c453d8130f294786baec00b7b70df1fb95f3a66282a3ba4401a53d878ff382e317abd0d4f09b7b","ssdeep":"","tlshash":"25f0e5e2dc12cc0fc3634e2d283e6c7532cdda7006a9624bbc94c9395dc6e380ad0d92","size":444,"data":"","first_seen":"2026-01-31T21:08:57.395189Z","last_seen":"2026-02-19T17:02:28.888807Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/5664bd740cac6a96.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"838e5b67c708c3caa4ccae2ab6eccfcd","sha1":"b2666226e6fb839315d216fb69074265386b6b8a","sha256":"3afd0a23cf42518fdca2dfc42bffe1b2c611189b89799ecbae2386434adc8e3f","sha512":"845acf9755edd329f45184ad9bccde9249a2018ea514934ae462a84992c69b4db39d636b842de7d5c71b9187c3e2fedab2b41095dadbbfeb40a683b3f9d8c76a","ssdeep":"96:p7ctuv2BtSDxfARZ0kqJFv2H43uuqoE91YTkqdYqiEAXjv2YM:oBtDRCkqJFezuwgYjlXK/","tlshash":"d0a1b6b231a0f490d16b4294c03b441eb27a2d3e609d71b493bd8cfd67e544de6a2f97","size":4813,"data":"","first_seen":"2026-01-31T21:08:57.248038Z","last_seen":"2026-04-28T01:10:54.184543Z","times_seen":182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"56349caf4abe4f80098d17cc84da57b5","sha1":"9dddd21f9e3d10ed06caa61cb9ca6108d9bc4429","sha256":"9c69e579ce81e354ea505e34972ed2739a74ff432308efb14e30278b969ee927","sha512":"53941b792038f5119af27067887a54f18d665d2d56c5b48105317e70568659cdf02576e310c858f2d35ab530062f25d3551c25d1c5b380d31f4a2ff911241c5c","ssdeep":"","tlshash":"1d31e89fd85af8507c61dede457e6fb685c6c8738434082cab9ee898003143353a88a4","size":1681,"data":"","first_seen":"2026-01-31T21:08:57.396111Z","last_seen":"2026-02-02T22:33:10.228066Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3dd7e5456b416553317f4bc0f42f3dd7","sha1":"e6b71a3431483ec6f4d77e0b4b4959decefd1cc3","sha256":"bc5e737eb1b8ad6ab52c63806fa9fdbdc1a68aa5f8d0f53a85271bcc2dbc2e84","sha512":"19308ae858b0749aadcc004ab10c015d4658f53649f94ae9a494a16b6b0e02ad8a129e5022b4eca748e41ac643203b4d268b52512e5f5b652f75fddc6174069f","ssdeep":"","tlshash":"eb31cc2a5c09dd46e97ead390a7ead3504888db347505f65c6adce0e298343c5ff4e10","size":1569,"data":"","first_seen":"2026-01-31T21:17:17.999097Z","last_seen":"2026-02-01T19:03:24.245116Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7e98d98370b9189e9319516ce9cc2953","sha1":"b62dd5b8392a4fbbd904529896e246f6f64095fe","sha256":"6e246b1adc6b2b9f732ec3a00a54a3c11898989e0d9c18de906831e16f33324c","sha512":"60178882cae6a4b351189baf4a0a7ab4f4711cca3c51016b39225ad74dd49e6c7c8d0188efd7145ea9445f296f1a882cb2a075788ffc292b88eeabe527ba6679","ssdeep":"","tlshash":"e131c69fd85af8506c61dede497f6fb685c6d8378434182caaaee89c003153353a89a4","size":1680,"data":"","first_seen":"2026-01-31T21:08:57.397856Z","last_seen":"2026-02-02T22:33:10.235148Z","times_seen":66,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"86a74f5f184204cb09ba94eb7c44ebe0","sha1":"82cbfc5730126f67a68bf55978565a8319a21e39","sha256":"9a16760c4a59f3b0e1befa7835483a7c388d3c0e2095fbb47e55ff8bde32ce2c","sha512":"77c0ddb1beb1be7516ad2eefa7a15bdd168a99ef9ffd957ab4dd8c5408a661bb43ae467a03e3c747d84f4cb50cc5eb3e2bb719a905fa552800b51da8205c19e1","ssdeep":"","tlshash":"fb31e69fd85af8606c20dede457f6fb685c6c8338434182caaaee898003153353a89a4","size":1681,"data":"","first_seen":"2026-01-31T21:08:57.398654Z","last_seen":"2026-02-02T22:33:10.235751Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/array/phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN/config.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"18c8e920a48d5bb95921e6187c07df2a","sha1":"fb3dd7bab6f2653b6f4a734c0624ef46ca779d78","sha256":"20333bfd82aee4085ca68fc8768b0b251267ca5b5c93d3fd464c690eeef54b0d","sha512":"0a10abcba25f402288531176bc4ca609daf16ad26b3d678b1de79e37dc449b3a647d29b4efc90e63d2153d273fc1d0cebeae2adc797fdd432ca5751f96cf9601","ssdeep":"","tlshash":"1d11ab1cf9a004ba00e6715c5fdbe1836fbb858792444c2cf5c40550f70ea2b9543fc0","size":860,"data":"","first_seen":"2026-01-31T21:08:57.376306Z","last_seen":"2026-02-02T22:33:10.199626Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/08c39a0012534f66.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ff39d75e72b017105228a3e3937e7591","sha1":"f2d18c32727ea5c8c3025c3dd6062cc64a0205bf","sha256":"bde5066619da447ebe65deb46930149c780552d9aeaea4827915013d287be571","sha512":"cc6a711c714a6309780c59e28fe35a28e70d35720b3c4f0eb25986f230329c1a1e047514909fc053fdf56233194352b7595f57e4de1271c715d0fbbc315a5cb4","ssdeep":"1536:0N29IxBQi6ha/rqj4gUnFZSul2PmOot685j:05P6M2jDRuPn6e","tlshash":"73b3f7f935d5f48207ab40a6c03f0006f32c5d37189e68a0a3e5ddda756499de1b3faa","size":111402,"data":"","first_seen":"2026-01-31T21:08:57.335286Z","last_seen":"2026-02-19T17:02:28.643844Z","times_seen":94,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fbcf6a3d4fa540a1cfffe923b3d5023","sha1":"4e793f3827a01e9c4e3d4550eecfe42ccc2cc00e","sha256":"612c89ad7a94b48c64eb1de27b51b969a3de814ab4d5ca2f17f4ab7e74c4982f","sha512":"a5d055d4a24fd88875fd4057d1e8002793101d1c95f9c846bf92e6cb4e205b42d0e620d2496dd730874eec5b2b6a694e377b9f723393c8464fbb8b95bff0cbe3","ssdeep":"","tlshash":"1d31f99fd85af8506c21dedf457f6fb685c5d8338434182cab9ee89c043143353a99a4","size":1685,"data":"","first_seen":"2026-01-31T21:08:57.39951Z","last_seen":"2026-02-02T22:33:10.236333Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5e2016cad477c6d44523ff529dbecc23","sha1":"6f96871336ef4f329929cebf82088de58f11e30d","sha256":"f52bac6565e51b0233babc08265efc2a896a1dc65a0a3373990de093f13f5465","sha512":"9e773dce7f8fe5f1c7b6e9f77f46c759f021e99bbe5d5860f48e9e9ceb7ceb762c70f48ab26f2a47b8cf34760c8fce89ca119a6a11400a34ac7b0754d67f879f","ssdeep":"","tlshash":"f331e89fd85af8507c30dede457f6fb685c5d8338434182cab9ee898003143353a89e4","size":1683,"data":"","first_seen":"2026-01-31T21:08:57.400264Z","last_seen":"2026-02-02T22:33:10.237544Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"41e3baa1d27b87e6aefc0590091b666c","sha1":"9ec659b0ab6c6b3d2a6acaa7c779aeb91c938da1","sha256":"47388c780cc20166fa2a712112df4cbee4157c67fe463bd38542f2fbb3ea457f","sha512":"f02b607d8f721f8a905592f50ff9b6298d3896b0aa7a3c0ebb50e1d2a7158c8e6ed1c66f4df5e1c9fcf8555f53fe6e2bf97a20bc56b96baaa71dbcb59a8b9492","ssdeep":"96:LA9bFtSSXV+lL82QbHjfBGN+XVXOEXV+xV+6XV+4VX8SeV+OtVX69V+KJV+DV+8r:j82QbHjfBGN+memCj","tlshash":"fab14678b41acd58ed8e3c15353f5c3a658d939b869ade62c2e8dd20828743dbf526c0","size":5438,"data":"","first_seen":"2026-02-01T19:03:24.249956Z","last_seen":"2026-02-01T19:03:24.249956Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/a7c7a8fadd85f653.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6736d35e645199d0fbb2c26ff1a4c4f6","sha1":"330babe7ad7a1a008df4fbfcc4aa2022ea5216a0","sha256":"a6c5341275522eea933fa0b30bbd42b98d1d5e1cf7db03c462ec5256d35523b2","sha512":"28bed02c6ff5722134d2315615d52efb1c3a29ffa7bb4da160554f9a7433ffbfb879ce9d3c2da0d6a67a42b3ad8476e0253814cf7aa8dd3197fbf256900127e8","ssdeep":"192:GL4RE0SZ4r+zeLhVbzB44ZdLIx+7TFnRA88KlWOfSeLzt:QOr+E5ZdkxGBnRA8flWOfSeLh","tlshash":"ed42c9546154aeece5bb00d1f82f810d312f3f98c60f8870b9bca8b91a645d43b56fda","size":12584,"data":"","first_seen":"2026-01-31T21:08:57.356712Z","last_seen":"2026-02-19T17:02:28.855421Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/70c45d6675f019b3.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"109dedfa8a9df629754107a4360cbed2","sha1":"dca0b5125582597623dd7a5f137bb172eacebd4b","sha256":"66937c36d62b42f9c0de04ed3961be40fff3bca6a84a6e8675ccf6bcb7bcb244","sha512":"75917cbf7e84472836f0f36f0d6204002de0ef185d062a67a4160f39b8165bcdb07ed964ccf923f78e9a4bec22cbda7fd444445695eb1f68f809df6d0d9a2def","ssdeep":"384:I+FjjzUO4kzleEPQKKUdoxUCHSWiDp1NpTLTJJQrtgG40/H5JiereqeCEYjYvbxI:I8jkO4YlMsdpCzifNpTByEqrddwR4","tlshash":"96e294a971d5f4910ba354b5803f500bf23e0c76296da0f4e3a2cdf9b9a055ed132f9a","size":31321,"data":"","first_seen":"2026-01-11T01:55:53.490165Z","last_seen":"2026-02-19T17:02:28.781185Z","times_seen":96,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"608fd6cc523b4612d3402a22dec9d5d0","sha1":"37c82c8cfd4525a81fd435008543adbc7d3b7ee4","sha256":"043c27cb26f2ef14ac14778fa0747367f7403b579ced1d69cc86c711b749fb74","sha512":"c80f28f5867eba996cb8e0f93f9535ec362f0193a170389ad78bec7e8632cd955cb3d6f4edfd3f7e33881d943d2f547b3cfcdfe9f6b27c3f94bbc6282d8a92f5","ssdeep":"96:LK9rtxsntXHvXHQq7ZISXV+lCZ0XMXHJCXzXH1fsXbXHD6XrXHpSMXCXHyN1XZXa:ooMGmi","tlshash":"c1b15a247416ce9ced9a3d66343f5c3e254d925bda8acf26d2e4d92083c7439af927c0","size":5097,"data":"","first_seen":"2026-02-01T19:03:24.251616Z","last_seen":"2026-02-01T19:03:24.251616Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"eef28e9ab581daaf336e2e3f2f0b725d","sha1":"2ec06aa3861dc427d39094f541d08cc5737524b4","sha256":"c95801d29c9738f76f5b75f0fdda37ee638ad6e8f4d44bc54bcb2f7c5c5c56b4","sha512":"2c4dbae63064653c106f7cdf30f7fe701807cfdbddf9092ee63eea3ae2295a1e42f65af67a4a6672367030969f5ee48b90900e5bf03ca38d695737fa73f94023","ssdeep":"","tlshash":"9231ee24b815ce59dd9a3c36393f1c792a4d80aad74ade1a93e8d96583c347d6f23380","size":1869,"data":"","first_seen":"2026-01-31T21:17:18.003601Z","last_seen":"2026-02-01T19:03:24.253054Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d67c9b2abb6b10d7ecfbaafdb5b9181a","sha1":"52fa0f7adc8b2d352b66abc1bec5baf4683d3f68","sha256":"27916dc2eefad962207291d32a8884d3418074afe51b41a5438d9012c7f0461c","sha512":"eb89060d7cdcaa6c876c85be38f2306f3b6b0f1621bf98fc61617a7e936dae32ff073c7ebb48ba3ca900673354d050f36f6adb1bf3e1bcd379409ccdf4a7fc81","ssdeep":"","tlshash":"7b713c687059cd59eccb3c61253fac39264d47aac55adeb3c2e5d960828b47cbf427c0","size":3505,"data":"","first_seen":"2026-01-31T21:08:57.403486Z","last_seen":"2026-02-19T17:02:28.902517Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c27f942349f4062694a39f2ca3ce5317","sha1":"66062a3f43737a25fed31db9b33fe41c9dca2836","sha256":"23d51377bb3b2bc289d3144cb79bcfddd97e7d18f066d99e88c7fd9b1ad61a49","sha512":"6714c20d82404c3c5fc77bf68e551cca73a51b7006301097877dda3182af4495d848b92321b43b8e86461ca1add3425907b0347506733f7c2b1e3a3107ebb75b","ssdeep":"","tlshash":"0e800474c1c00c17c173003f54341001017c4004444014001354515c1013355551fd45","size":34,"data":"","first_seen":"2026-01-31T21:08:57.405082Z","last_seen":"2026-02-19T17:02:28.90331Z","times_seen":66,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ac0dd6aee1f82652ddb3d2f6f22fd526","sha1":"b3d90e3dcb9b8476b9ceb0b1d7c636e5cebc88a2","sha256":"cf3febcdeae6ecd677d81e0cc3689589a76b30be5f334ce8d1350eba213dc3e6","sha512":"b5cb2699e8855db9f35c8fb1ed90afad099efb840c467e56d2c73a8f7eb920bcb6ceee6553595b86d453d3cfb2620e902ead1d7f2c19b80a7c4c4dd9210d7e9b","ssdeep":"","tlshash":"1f21e07162ff53b4541873f4c9278aa2bbdd2c787b49e788ca06cd1192d236ccc99897","size":1411,"data":"","first_seen":"2026-01-31T21:08:57.40602Z","last_seen":"2026-02-19T17:02:28.904038Z","times_seen":66,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"056fb3c868a551d7e6a64cf41ae20613","sha1":"3888cc639eba121e1623d9b6f07b38302dea3787","sha256":"1bef12ad84df3ffc564241391a9a54db7333e3b975c08b0dfb015d5c240475a1","sha512":"adc0d6f75ec696cf7f55f5c1d3f4bdf300aebbb762e7fec00f0e6e39e6b1c01a63b5f29b35166e857137e19390dfe30ff0102d7aeb120b2881578c8253cccd69","ssdeep":"","tlshash":"6f2142e556f435e0e601a3e0cc2090a87b5a20be2b27c6dcabd82cd0e75015d436cc93","size":1295,"data":"","first_seen":"2026-01-31T21:08:57.407054Z","last_seen":"2026-02-19T17:02:28.904795Z","times_seen":66,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/op1.js?v=1.1.3","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8bcfe273763be53ba87613b21d4bd80b","sha1":"0784b9ce9f450c2bb33a9b08a5f2de2633e0a481","sha256":"d79474635d2a5fddfea4f74fbcd168be27fa6a40545ef2d801cf146121cd41c1","sha512":"f5de8b0a6c09c0502c0d247d566d69ee8deb3e67b463d7a31de7a5e0adcebd353ea513f084a6eb4504f602999bba6806015b75930f464a7aa6b7d7ba0290961e","ssdeep":"96:aTF5H5HQTNy2o4j471V0HjDkAMEmLmwwrHGNsuNS3DWmoLxu:e5Z52DjM1VYjwAMlkrmNseS3gu","tlshash":"7bc196e332ea25f246ee74a9d6213252a73817b4340e501cb76caddb1484d06b3e5fb4","size":5906,"data":"","first_seen":"2025-12-19T01:02:07.6499Z","last_seen":"2026-08-05T22:14:11.448888Z","times_seen":274,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/surveys.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"eed1739be3b5f3cbcb8b4348da95df6c","sha1":"a6a9bb3c87a1d6a5e9a3c3fa4a504cdf5fb8c933","sha256":"aa71231d82c88044f916cb947cd23aae69f132701555cd8bce2b400c55ba388c","sha512":"cfbc612fe5f11aff4caa160599c8b2bf4291b118f8343596b0f447b2f5dc996d1cfd333d57e2893830174b1f6229dd49a8028dd13d3b31fe8648646e1eed875c","ssdeep":"1536:JXbkgL+74ocKIQvuE1p+5WeLIVZCnT9mYGfp/r4BL:1Ygq71zgZT9mYhL","tlshash":"b4934cd5b640f1ae41df81b4207e4842f33d2b1afa0d4958b157dc943de9848a39ffa6","size":88854,"data":"","first_seen":"2026-01-28T03:11:07.691683Z","last_seen":"2026-07-15T13:28:32.229743Z","times_seen":1187,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/8a9983e0eefa6ffd.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e2778cdf6269909553d3706405b77a3","sha1":"aa1028f797111fbd2ac1fe8befbc5fc3ced497dd","sha256":"e05ee3375ac81e36ce934885bd42fd26f7873892d52da992947b6ca7ca198772","sha512":"8343355873776a7f3aa490a93a9d79e43be7527396f977f53e07ec8552e29b4fefd257638ee0c3e1e4ca1f9df0080d4bae32bf866763876a99daa0d247e9804b","ssdeep":"384:fBNKeDneohgZlz7FSwiSCD7jVCdBLrS+X1Fv2bTNKcjGbvYekGLLoo+eqfQS5y:5Nurxh54fVCb++n2babYVoNqfP0","tlshash":"04d23f159165bbecf53b04b8ba6d806c721e9b54cb0f8939f5b83c311a410d47a67bce","size":29243,"data":"","first_seen":"2026-01-31T21:08:57.384918Z","last_seen":"2026-02-19T17:02:28.621203Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/e3b0cf32d3668e3e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4e5379c1bbfbb186f837f831921c4f13","sha1":"e3b42b23015fe4463332662702dcbdc12efd3256","sha256":"fc40324411b1ef5263ea87012729f52d443136ffc93caa8940b43297f86b0c25","sha512":"45334f3cda20eedb7c3304206c9ecda79b42979634544f7eb54ae9b6fc8ad133e9b0cbe0dcc15585f769e74d50e0bbd599f8a2b5fa43a1a3d844e250053185aa","ssdeep":"768:jouEv/zy1gk+eUNXbkX+4BNtr3kJMlDE3BkefskEJ5sa:cuqu1gk+eUVkX+W3wCDENfskEJH","tlshash":"bae2a5e63602ba73e3dd01da50b64459e37e255e2009402cf97d5cae3a78949c0ebb7b","size":32483,"data":"","first_seen":"2026-01-31T21:08:57.293702Z","last_seen":"2026-02-02T22:33:10.107202Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"56d8274024110729433416f37efab4a7","sha1":"9ce642df9eb8e6df598c3899f0af7396695ac609","sha256":"e7a73617c3e9a07bcd76e1da67ba246c84a54cbc23ecb492eaaecdc673893fd5","sha512":"e9f79e8c9eb37d2c2ac2ae6b8d9e4f1be7e22814d1e2df68fac0ab74a67802222daa3e393385cddb65133f52b7495d4302abc4fb521bf35557c83031051e18d8","ssdeep":"","tlshash":"fb4175757055c86dfcda3d962c3ffd2b50cc82ea8686cf19d1d9d81002c60797b91ac4","size":2200,"data":"","first_seen":"2026-02-01T19:03:24.258724Z","last_seen":"2026-02-01T19:03:24.258724Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4befbc02ffa04da477e759d492ba8173","sha1":"85706bb70f936ee7794ff823aab301135d0e4738","sha256":"036de481c0aae69a2566ea07f81a63b92e18d3d80341ac23246a685cd6c9248b","sha512":"3470f36c706b1017d8450a0a39e0f4ea4158ed75ce9528fa7e3a12d52096696d82d0bba5a95a5972c4b6c6a117061a0c66aa7883f605ce4011a1bb915e45ad31","ssdeep":"","tlshash":"28018139a120c9a0cedb122b793f4dae2b8c94c94708cc00525dc66973c28bc9f3b080","size":818,"data":"","first_seen":"2026-01-31T21:17:18.008105Z","last_seen":"2026-02-01T19:03:24.260144Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f116a6e17b5499916aa4cf9c14e37464","sha1":"29226226a8b7d7e33f7f62fc4b0bb916e1bea585","sha256":"eddf47d0daa5a948c6e1de4e311178d2ae6cceb51723228f9f289f558a2f24c4","sha512":"158dbdbd41fff026dc343ecf68cb8b3ba24d458e69d52b195dae9168188e205e53af0dc2a77664c83573462993176a25990164b366537978bf5487660a48ac1d","ssdeep":"96:LvTkUIBhk3/TtVdzgmQ1PfNjliKSForEUTw+S59qR+f:7nA6Pdg7Nfll7fEUTwVgy","tlshash":"bc816f806b7bcab8f515bdae0b337c343c0128d32a12d195c7a5ac09d99443d5ea9ceb","size":4181,"data":"","first_seen":"2026-01-31T21:08:57.410236Z","last_seen":"2026-02-19T17:02:28.908805Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e0e3483dbc707afc9343e409b2ef302f","sha1":"93a083c54d32eff9ab330d1467e310821446792e","sha256":"d075d9a8eab512645a484b04ddd2880f2662da6b4f291d416dd7a74437d2425d","sha512":"725d3686b97380c5edee24a9bec48c2d9264310342ecb8f2b79d49ee8ee61738aa5cc50a17f2f22ea0ae8537e451f1c2ce30a15f9798d3932e87b609d3bc6b32","ssdeep":"","tlshash":"d6619548b35dd6e4fc45bf9e02337c743c9128e721079999cb859e28e04403cdad5cea","size":3437,"data":"","first_seen":"2026-01-31T21:08:57.41151Z","last_seen":"2026-02-19T17:02:28.90956Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1028b0ae55fe86fa0135133a581f59a2","sha1":"9e391fb7cb34a6c09df81c765c9aadcdf2c8cc55","sha256":"1bb94cb864247f1b5105fdc6448b85b7b0b6415b0f1142b5d7dee84e8b30c2a0","sha512":"b774af72139ffc8e74f5d682b5cc48e68a5499a413dbd7e9e233c0c332f7807671e0997ae3475b8503f1e651c1b5a342c9a52643950780440be57185d3a10d82","ssdeep":"","tlshash":"6341ffe4a3d192b3234d7afd93626837f903e8a27916e0d981801d79581549ca9f4cbf","size":2042,"data":"","first_seen":"2026-01-31T21:08:57.412207Z","last_seen":"2026-02-19T17:02:28.910272Z","times_seen":64,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/b56bfb8753f2111d.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e68a13c76892f30a85efabb13d82ca1","sha1":"966afd56bd2dd10ac30443a969c57de7820276eb","sha256":"143ac296f86033ddcd6f04439e75754aef4136412b75872a710be987fd05f423","sha512":"7efb5a92b6fb9e7cf28fe24b78c7cd93aaa393bbf28dad89e0445c7790de25405e6caf21dbba8602c134dc70d37361234d9425cb1487dee4b6e331616451ac12","ssdeep":"384:u2HyPM3ojR4oAQgGTH1BS8UEHMupcS3hHgrhiiGE6oSmLSpfz7SG2n6:u2Hy4lCHdMup3hHOiiGN54Spfz126","tlshash":"b2d2c7e33112f4728adfe2efa0a70466a33d26189409453c7d7a9d8d326d6447297f3b","size":29045,"data":"","first_seen":"2026-01-11T01:55:53.570094Z","last_seen":"2026-02-19T17:02:28.73521Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/e3d00364d13321ed.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2486934aebd0b00e55e68b6dfbe9d0fe","sha1":"848dbefe394be98e044928f1374fb59929c92f93","sha256":"11380db3ba8aec5597b4cde9773951510aa89424968a8c7435db112f37901b0d","sha512":"807a83e35db9c4bc646787d3a154bf2e80e386daafb9fd97ea6059fbde48bbc924847a8108bf120b524c4edccc89acd8e5139ae522a1a2655a29dc720a4df54c","ssdeep":"192:uF1HgFrAHRNiN/Rv3cGggerToWWeoedmPWo21UCS+94eNSIOEPZJJb1I+7mTH47C:YHgcRNiN/ojfoWpHmt21u+9vdmTHS5W","tlshash":"1382b6ea7282f0b197bb10a2c07f400bf2793565245d4054e7a6c8ef74f056e86a7f7a","size":18259,"data":"","first_seen":"2026-01-11T01:55:53.455045Z","last_seen":"2026-02-19T17:02:28.7957Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7dff027882da0341495ba68ca5b56b9a","sha1":"4f4d37397b761b3e98faefb77a8b942ebf95baad","sha256":"a594cc7275283b67b7400bc9cf684cb7ba5367425208953c24221ebdafd9b6a8","sha512":"d84cd09696bfa64b64f2fd4e785d1a2ba030183f92cccf9024c5d22ca00d5996d25e9f98f756e55a00409ae7c7b576016398a57c3d1199b17b697d22f326070c","ssdeep":"","tlshash":"c98000b0c0800c3ac0ba00233cb8300222ac808a80020080e3a8a08c22322ca8a8afce","size":34,"data":"","first_seen":"2026-01-31T21:08:57.412868Z","last_seen":"2026-02-19T17:02:28.910984Z","times_seen":63,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/944ac4923c54ffbd.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e0a3c6529b52f3ca76fac8b4824ee9af","sha1":"38b98c5b73f6c046e438618cb9085e16dfa344cb","sha256":"28f068c9ca2b7701f59bf1e653a54c3000dc2191a0800c26c1693ef283148541","sha512":"bd0a312fe3106a32e07f3c53a52c6ec5f4d434a2b485995731710da7d9c69c8f1aae5536cdb8469914ff8f2228875d802ab55d30af07eb0183e371249fa8b94a","ssdeep":"96:ESEwSEWAR3IWcvh4KyqcnnToxHYypVENVIctVwdj6BKGyFpEKo:H1KW/nExH/pVsIctC6A9sd","tlshash":"ac915494a990efdcb45e01a8a03dc00db16d6e6dce1eca39f1ac34b129550d53b6b7c6","size":4385,"data":"","first_seen":"2026-01-11T01:55:53.465489Z","last_seen":"2026-02-19T17:02:28.643228Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d9051b8fbc6d56b1cc51ca5858a4b82a","sha1":"afea37999959d990d87a327c8e39eaf603f9f0f2","sha256":"c6aa20662b3e22992c12f4e69cd335bb7e6ba28893d596d8674e8c76016d3059","sha512":"2e4dd93fbfa65ae811516da2deae1871fc1495ccc63543a738cf67472ea4f3f1e0aaccc00cf3092f38388b7555be212fef4a55da7ee1ac7d457eec4c9080e314","ssdeep":"","tlshash":"b63145e45161cb7cf946be6c99232d11cd019deb7d91d4d641915812d0690e0cb59cff","size":1828,"data":"","first_seen":"2026-01-31T21:08:57.414289Z","last_seen":"2026-02-13T04:13:07.757219Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4904d04204e17635b3b5578b35c9ca30","sha1":"c0b6c903fe8c2f835b770549feff5d28a249b4aa","sha256":"9f44e491c01757f421aa47b533342eef1f9f459854a2161b91243b3e955f1693","sha512":"fdf27fab923ac1b2c44209b0f701f1db57d081814f59da811374467562ca84074a1d6fc171bda214378f2aa1dbdf1587df59a09e0bfa32cb49d6bc6b680bda38","ssdeep":"","tlshash":"77117275b01ac959fe993c06383e6d3b6049839a8696cf65cad4d861414507dfb42ac0","size":1072,"data":"","first_seen":"2026-01-31T21:08:57.414993Z","last_seen":"2026-02-13T04:13:07.759685Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/9c439f77bcf7138d.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"84c3a7bfbd13e6eed8ef2600eaddebdc","sha1":"492c5eb4c2b6ea7d50aa47251107d02af9a99efa","sha256":"c010c5927a47a70ff2fba12a2c2fc224103a5ba1db45bff25a3c4ff53a7ed2db","sha512":"ba4d7713a6c6d0abc5f738d03df05c512d350afb9d0fca1ab43758499c61f0a263f9cc412611e7d64cbbb82481b03ea62829c5cd8719234fa3f46bac724dabcf","ssdeep":"768:B7Tl+Bi1HaSiLD3XirHJdPYKENWNDRYEpEzf9MSnS61ls0c2kXBdnXDnI8qhxCYb:B9+McSiLD3XiWIDRY0EfUH1XMOYb","tlshash":"2c13d8da73607251a3cb515cc4af0b81733758ec2019807c3a7da9cb69b0a5976bf73a","size":44681,"data":"","first_seen":"2026-01-11T01:55:53.441745Z","last_seen":"2026-02-19T17:02:28.745023Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d20642de5598670fa53acc2944bedd41","sha1":"607780618fe3f368ee947c55c7d3f27f6f8499cc","sha256":"b23a3fb96d58ac053ddadd6e53df1eab5ab0c0c083e7564fb76f4e703a065db7","sha512":"2d56e7c551bcfcf59e5deca97201e2a61033d0df70cab1b96579e045b9dabe39e34f9bc4c9055d95365702fd8f1d784e3e1f13bbecc078497b7df414ca34bb81","ssdeep":"","tlshash":"1a800470c0410c15cc35001fd4341101017c400c40001441535050c470751075f05d4d","size":34,"data":"","first_seen":"2026-01-31T21:08:57.415703Z","last_seen":"2026-02-13T04:13:07.760311Z","times_seen":54,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/dead-clicks-autocapture.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc981e3687edce8a3d22380972ee45e3","sha1":"1955fa562b42c9f134b62e7ac0e9c11bbfa4da75","sha256":"a40d91c2014cca52defeb2481998498f02fc53526fd05302df0e0e490173814a","sha512":"2dc021b1b3ef375290f2d59d97ccc6bd6306aa4af2791c6cc29a129b50acc89a0566e5b27074037312082f55966c0bda2d77ab2ace32ad4a2154d08176e1c2c1","ssdeep":"384:sw+VM/tkSeCRi2WzHiAOjCQBgxjOJWgikn26FT:n+D9QeOMgM6FT","tlshash":"69420a88b7d0f3b12bd7145ac4bf1702f03525082556c824b159ecdab4adb1622bbe7f","size":13059,"data":"","first_seen":"2026-01-12T11:07:28.642714Z","last_seen":"2026-07-19T05:49:44.303002Z","times_seen":5178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"cbf89f93643bde77f1a42b20b7aa4b20","sha1":"0a149ced46b0df0a7106b46d2c013b787e24d389","sha256":"d797c2255ede2cfbcaf8829f073737154e2d44a574e9515dd10a02218835afd8","sha512":"9cb0a7f09706264d23a46d6e04d89824fe6cec6c4f0d7e8a2c72adaca8f587ce8b0e2ec2fc3210e4d7c25627cbcfae4af163fde9f31347492086b36111030177","ssdeep":"","tlshash":"ab9002a931c2e0009a533364505f18cc5074c47024854981845494a15c65024521a85c","size":47,"data":"","first_seen":"2023-04-12T06:31:27Z","last_seen":"2026-08-07T13:20:44.695793Z","times_seen":26242,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"cc5fe6c5692f7c6888c23eb005d33bd6","sha1":"41751e1b3e744af66fff031760e14f39ab8e7e11","sha256":"c2fc027d772d7ec9cf978a65b519dfe1713fea1274c77e3803d45c6986b5ae4d","sha512":"5cb8da8eaca5c7c45243b34ea40b1bdfb0e44e2f7f2acdc1d07b6ebfd0663a576db364afbd777e7f8ec9709a33f841af426821afd9d870a44baebe54b64db262","ssdeep":"","tlshash":"8d31d09523ed92f9f048b4fe291594502c9321df7de2a178db613d20ba911484ea1fef","size":1710,"data":"","first_seen":"2026-01-31T21:15:15.04624Z","last_seen":"2026-02-13T04:13:07.760879Z","times_seen":52,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2c67b78482e2ea3d05b16b8900491c7b","sha1":"0baac54493aae6f7443b7012cc9e219e2ead8e66","sha256":"2029b1ef0a1d17b6c66fa84330d55c085d32b3f1b5314178251f97cbcc22e2b0","sha512":"ad4d5ef97e94962e57c22494f10bfa90120a0333b9656c72df490ca43dee7b2f19d007c1f0a84de0f3fa1c0f1ef6f0934be0feb7046330cb4c1dacf8586d4849","ssdeep":"","tlshash":"bf219ad53159d468f808b6ef07337c62e82a5ad555f280a8d3938948b4c68b41e14da7","size":1213,"data":"","first_seen":"2026-01-31T21:15:15.047034Z","last_seen":"2026-02-13T04:13:07.761422Z","times_seen":52,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5e94ee81f01b6c46a34d25cb1267b531","sha1":"316f65f45b52c49e2826a59b6d9e7cf098b3f163","sha256":"32b6856174f405088385c8c6681f87e5a23d98cc00b168bec5f7e65553f2967e","sha512":"3413b9f5962b070ad7ea7f8d7dbbd28e47e7d00c706a88778bfc71b2e67f4ec410518fd4177277c68ff80807180b2e2dd619ea18c6d43f8718b0830e5a8eb0df","ssdeep":"","tlshash":"8c21110471365659f95ccdeea2435835bca28f4578398f28d2f2192dc8b89ec0d794ef","size":1416,"data":"","first_seen":"2026-01-31T21:15:15.047952Z","last_seen":"2026-02-13T04:13:07.762022Z","times_seen":51,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"47fc33a115bcbb7a73308b5841dab94c","sha1":"9131ee30ce6eabcfb4c5538393de2e805969b0ec","sha256":"070a80f96f4e8531b9291857d19b97c2fe9bb8efc157863a45a702b308657561","sha512":"a9aea81b3c9906291620dd40fbcba69d34381e50efa5a2586068edf8aabdee4f1898db68566ffe26b69e7ce8e1cbe19446cdd81fd5c95d3354e5563b5b13281d","ssdeep":"","tlshash":"66b01275f089dc26cc75342b01b62e3105bd00c7000184005f94d91490d217d6702d04","size":102,"data":"","first_seen":"2026-01-31T21:17:18.014273Z","last_seen":"2026-02-02T21:49:52.989006Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c236e034006be48f651e4c6107d6c686","sha1":"20e4747bfea14c1312892176aded7f55c54670a0","sha256":"4de59df36b741479a9e648ac3385e37a5f2b4768ba5f46a4a1d24b9eb32a2705","sha512":"72731abea833d808e6ba0ba0c6687170df85c183efcae6f069a4855947ace432c0d8d1cee528187ed76422ed705069e3dee8d6760df6df7b7d8d5882fd50ff0a","ssdeep":"","tlshash":"6e31d2da6649b1c07445d3fc041358b4ba8b387b2f134aed86409598af54e98ceedce9","size":1451,"data":"","first_seen":"2026-01-31T21:17:18.015001Z","last_seen":"2026-02-02T21:49:52.989871Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b1eb7fa09104259b8c4160c7aa5426d3","sha1":"129daa1018dd0207d9839d74a255c69db499adb9","sha256":"c0fd47073ba433a65ddb3a086f02d928ec7e6cc913295ec120fecb0f9266b243","sha512":"65715b1065c0a2a4f2f5bdf16356746803c2089dd6089663bddfecebb08c55f8309f478676d2e2232a4c7e054f85ac357cf998f7045b4ddd0ff6068b8cb0403a","ssdeep":"","tlshash":"22b01270e049cc36dc35381b45742d2101fe40c6020144905fd0d564e0e207e6603c04","size":102,"data":"","first_seen":"2026-01-31T21:17:18.01576Z","last_seen":"2026-02-02T21:49:52.990754Z","times_seen":34,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e75b8340fa5dbcdbaa98f4a9ff444843","sha1":"d343dfad942f061f0541260081f37825f145dad6","sha256":"96793ac56e4cf2bef3d2345d9a0e93a44160dd6a8babbcb28d1730d8835317cd","sha512":"73eef66a783f0853e28dd9d4617e0f5a387f02fc602b73917f24f3f5d1ea05e22ce2eb2ad44c9720132c4377699a520d3135391395f67da3137297f5cf2abebd","ssdeep":"","tlshash":"3b31cfe12b3d60f2f22bb8de84572539dc0271db3e03888bc3b21d593159d5989594f6","size":1552,"data":"","first_seen":"2026-01-31T21:17:18.016952Z","last_seen":"2026-02-02T21:49:52.991677Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a50b8abb9c9b0bb0df3bbdd5d4f56a8c","sha1":"e8203ff2130935192b95a67e69f4255a853e56a7","sha256":"25019ff5dfa77bdf6116a10c3c679e4880d9794055f8b6495196968a5926122a","sha512":"600771576212b4e589eb68407bfd63113195d3052063566ccdde13af47a2f98000f64a8bbe377e555e4ce744f7775bc6252dc92e6919ba4e58b3d9267801467a","ssdeep":"","tlshash":"56216e847726d930fc267cff02121f383a9528d75923549103d45b25fc118b6cba48fb","size":1403,"data":"","first_seen":"2026-01-31T21:17:18.017636Z","last_seen":"2026-02-02T21:49:52.992632Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d7448c3ce60b7e49f4ec281d127d7f8d","sha1":"3246e82d721d35d9b2a6ee6bd56af3897f08de00","sha256":"a30a9d83e89b24dba1f29f30295ff41a15e2ac9c601850300158dac25983ed71","sha512":"d8be59e14e91a9457209ad0d2e984c19c683609a5f0a96336186b3a8fa3975b6a26f9d789f449f9d38af88dfe58d33132eed43d48424b54476fb392e9d3e9e42","ssdeep":"","tlshash":"32219dc093a7f7b0f145f86dc714772abd8c61f6531396e582928f48b8225e2c8b04fa","size":1405,"data":"","first_seen":"2026-02-01T14:20:22.539377Z","last_seen":"2026-02-02T21:49:52.993452Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"41991b2ad6fd74830ef3fffe03af7281","sha1":"d0724bde873dbfb44164e2cc16509c6a005bf753","sha256":"1e4c05ff7f9b7e7554b1c288e42121fd9b224065954e16c175955fd38ca2a239","sha512":"166662558a7dcfdc8528babbd94770c5597948ef3607b54d4af5cdd1300756fd3381b9858a61a2d591a2c86585185332e40130e3868bf5bb45b0b160443fe135","ssdeep":"","tlshash":"4c5110a1a327cb7cf5ed38ff01ba2c28a9469cc16641d80a97c0dc5640864bc5e636ef","size":2689,"data":"","first_seen":"2026-02-01T14:20:22.540925Z","last_seen":"2026-02-02T21:49:52.994297Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7b916db3a446435cf3c35c39db0e986e","sha1":"a66a45e7bd5c23d1d46695c5892a9570ed9a0e93","sha256":"c0e162db71490ad1be2d61647687e14ff01ad435d1af06e34f8476c065549773","sha512":"4989aa1ce760962f47e88ba2a36368b7601e0f0a9ebe8fe244b71a50079560fe32da81aa1d2a60785295970b105aa73420afe34aa6f84ef00142aab3c7b17230","ssdeep":"","tlshash":"0d31e89fd85af8506c61dede557f6fb685c6c8378434182cab9ee898043143353a89e4","size":1629,"data":"","first_seen":"2026-01-31T21:23:58.02761Z","last_seen":"2026-02-01T19:03:24.277933Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0dd0588dfc4675ae203fca55a1890a90","sha1":"249d49c75ec985346762fa5102371ec7546993a7","sha256":"9315449d024f1d6837403c8e5437013af46319941e2cf1fe863c45fc9ce005e1","sha512":"fc670e934b3bb8fac1b58722bfeb4aca8e007c69a864f107d01ab7c975d19b4f5d52ffa59abf9279b01bcce5661a210b5e14ce2e258f30c9fc2c5afb9118a34b","ssdeep":"","tlshash":"4131e89fd85af8502c61dede467f6fb699c6c8338435182cab9ee898043143743e89a4","size":1640,"data":"","first_seen":"2026-01-31T21:23:58.028513Z","last_seen":"2026-02-01T19:03:24.278613Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8c20f576e0d288c5d5a8c9f239d498d7","sha1":"19f8e3b42998604e11907d2bf1f308975e67c393","sha256":"e996a1b99a2719e2266881ed5b898941212f68bb9721bd41f5463466da0868f3","sha512":"2fa22859ec7c6b4a39fe32ecc34172543a468cc750792e1a3fb23794ee9c435afc96ec13b5875999c134dc25bde1d9108c798656c54370238b8f4d363f7b1e54","ssdeep":"","tlshash":"6d31e89fd85af8506c61dede457f6fb6c5c6c8338434182cab9ee898003143343e89e4","size":1622,"data":"","first_seen":"2026-02-01T16:48:48.862107Z","last_seen":"2026-02-01T19:03:24.279346Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/3d29fa3d9e6cec4e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"103bce398bf72f998ccceacc2ffe6e80","sha1":"db2b28d3061395776a370a3539b6ae3bf15d9dce","sha256":"29b058437c3f7686ecf84d33045a537cd24e4f01807e2af5cec8649b51b1dc18","sha512":"10f6ace8ef1373d40e4d4376c214dfaa5e4a45a1dd6a6a0106a59756da63c78791241555c08f24471707cff6fe63ed751d2acc6a6dd00b6ca7538073507e54f1","ssdeep":"96:v0dZm2etxGIWIA1srSVMS7frIDtjyMB0whWDxcxv:R2efGII6sr8j7focv","tlshash":"97d1734891969bdcf5b704a8e92e816cb06d5fa5cb5d0978f9bd38351e000d07e69bcc","size":6370,"data":"","first_seen":"2026-01-31T21:08:57.217994Z","last_seen":"2026-02-19T17:02:28.862354Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/82dd7d6267e09cb8.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/82dd7d6267e09cb8.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"bdca-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CTpx%2FK4O9Y0T5dO9z14HtSXKxZPjtYYtEbJEMyGJ8L1pUyAPC3tfQd3v9ArKe4OkGsBWtFJkTzO2RG5WHSJkT%2BwbUnlRPBTe2rkSsK3aH7DAzVWH2Etw3mM%3D\"}]}\r\ncf-ray: 9c73b4837f855ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48586,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48223)","md5":"f8c4246d22a1a06a7f417da630df5915","sha1":"9df9c9183bc1b5f82cd24ea69b7e25a5af00f7de","sha256":"853c2c482fcd17d31f8ed4788c289e260c3da301ce12fc9bf6ba190e61e512fe","sha512":"e5b56350b103b601538c2762ecb1a05102c648b66436ccf600010f6a699bbcce8ba8498a84c30a9f3cacd1637c21100d92e574d9d960c8e040936eee9261924c","ssdeep":"768:HT3NPN5/4OYWH7pyZpRATNxU2nwSre084SlFO1V+mtmlCg3v9aCjUeVhWqMDPSRn:z3NPN5/4OYQkz2To2nwSrex8jm3v9aCv","tlshash":"3023c660b14171762a4343e4442e03096f3e79b4678c546bb7ac9de71e62cca4a7ffb2","first_seen":"2026-01-31T21:08:57.230118Z","last_seen":"2026-02-19T17:02:28.742744Z","times_seen":71,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/96f87de005b2d6ad.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.663Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/96f87de005b2d6ad.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"e13b-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7DZXVuerKC%2FVy5AMJF4rvSv31QREQ3fcW5TxUGw0%2Fv%2FnsUhIXdGb54KHamgFNKac2%2FYBOcd0J6ci5NykAsRqxHODN7%2Buhlo%2FlKtlDw8zSb%2FHx8hPU%2FExUus%3D\"}]}\r\ncf-ray: 9c73b4837f865ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57659,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (57302)","md5":"17eee88a9831d2853d077fe62f93ae7c","sha1":"b04fa48c468a9688c66373657e1465eaa00e7a80","sha256":"8846cbd91af5225faad20ca5ed7991bb165ad456444ba4e344461fdcba871828","sha512":"755666295f002303e0f46c2628e8f68d3de5cede59b52ab09ac12fa7b8813e130e25d90e2bd07e8a23225bcbc995b428e5631e665dcf67dd84649e4f1d6fafa8","ssdeep":"768:bVoeIOqOdU7FKN/HtE228zbG0Muf8cAyHHyhXmlgXR9DmKcxEeZD:bVo3ObU5W/NEH0MJyHShXmlCDtLeZD","tlshash":"75431999b111b87685df92eea05b14ad733daa0cc10dc118b97f9cad232c5e4b153f2e","first_seen":"2026-01-31T21:08:57.382489Z","last_seen":"2026-02-19T17:02:28.740655Z","times_seen":71,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/ce44054dec8673d8.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/ce44054dec8673d8.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"2a759-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=paj51UHAKnqPKlP6E1zgv6kxhEUZ6veflYBqC0ZKDYkRfl%2B%2BhvUcmtX871vcCQv%2Fv2OJpSEtiOXLdZnKrKG%2Fa4ikNb3dEylbYy2%2BLPQmzHDZYhU8P80%2Fsz0%3D\"}]}\r\ncf-ray: 9c73b4838f8a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":173913,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"55bde39edae3431bfd62768b8daea510","sha1":"9db768e745799c7b53bffbdb618c2263ab3557ca","sha256":"00a87cb86b607e19e592958bce89d185c75348ab44a92c12981c1b643ec1f5f3","sha512":"2da1e992c32123c7bf657c5e5a8e22f89aae2ad011483788ab2a009ffacc9a5709284f624c13cde721c732cbb1fe2337e0c40541499b51687862ff2e896ef008","ssdeep":"1536:BSUFcXpf43D/mr5hTIEdjDjJTob3UoYq06KgVH3TgTUcvJsgqzgx2/xWCSqlX3mX:BvWXpfsTzj91E2/DSqlX3ta","tlshash":"da040bdbb779d02249ed90e5d0360103e33a3b4e5548842cf25eadce359d94aa27bf36","first_seen":"2026-01-31T21:08:57.252675Z","last_seen":"2026-02-07T15:13:58.776301Z","times_seen":77,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=1cks5","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.752Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=1cks5 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-98bef38929625238-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=1cks5\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H%2Fkthnjgdjysvas9wZUmqyNWsoNdqiFTqCLMS5Lkvd7XEmDJNWkIUCxQZswx2pkDUuq3iew5jSrvS%2FWR%2BSe0fLX38uFkgtBMuN2H9EBrBeifOA88j%2Bx94c8%3D\"}]}\r\ncf-ray: 9c73b4973b9e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2697,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1794)","md5":"c8ce274153d6bcb4cbbc93cf831022e7","sha1":"3593f07ddb8ba1eaf7a89e296f9f12adc9f13967","sha256":"1f9fd95c91c407229b8939b7e5db566d530daf700bc10fd2e6d237a0f46e7a7b","sha512":"a0d43740a462cd9e041edb23f1c96cb2860f1d2198be31acdbb82b84607234ff28ba8a200f6669b3ec2cb63070678932205a2538393eb8b12b2bdc82acab8c89","ssdeep":"","tlshash":"bb51769bdc1efd584c21dc5c292f6b7691c58973cd348c9ceb9eecac04581271b891d1","first_seen":"2026-01-31T21:08:57.340014Z","last_seen":"2026-02-01T19:38:23.498846Z","times_seen":33,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/iron1.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/iron1.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5178\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:03 GMT\r\netag: W/\"143a-1930f23c618\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KbZjOao8CsbwXJZE19ePRlmwp3UYT6tUxWoPHF5WSnZwBUJLg0rKr5CYC6F4xVkPmBe5xH4eVcuI8itV9ItFpErnnNMEqGtQiT%2BnWMwRH7VjN91B4NIHmyQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c825ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5178,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"aeac0c9d6985d75770d9fc9678c216da","sha1":"f230f4b921a9b3f50c559ebfa807b9af758a9bd7","sha256":"eed273a22b1add3b4677e4fe47438f2f610db2bc75e1a7f06ac6298505b6ffef","sha512":"5babbf40391a6fc6a700c9bf92d1b3cbece6d746f2e058416f8f9b27ba13e68300bef643c0b6e3b40e9770e455b7b50195f1f04835b83a1ae837920ee7aa895b","ssdeep":"96:Aen8uSxTbgZHeCGL2DMl93qnRV4Meo3TIUzzq7tCR+h/RkCS582Yqr:Ae8uS+5et2DMl938t7TF2T/RkCu80r","tlshash":"fcb16ced94d4626b77f21868b1758b1156fc30e3d938140bd0d0a4bf8e183b6c563364","first_seen":"2026-01-11T01:55:53.464722Z","last_seen":"2026-02-19T17:02:28.871721Z","times_seen":34,"resource_available":false,"data":null}},"time_used":583,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":581,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/reviews?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /reviews?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-95d3a738fc278396-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cLRjb0D%2BeG5k%2F3mqm193W14YNSkmAGxDGsxWMG72EadOtlbW5ozyo1wgEMJ0f7ikv9uPiTuYnAQLQhWpSwKDcKX%2BAKkcdw80p4fK5ht5IpM3VmdrJwy4VZA%3D\"}]}\r\ncf-ray: 9c73b4912a5b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2471,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (962)","md5":"b248989db3688308e745c8acb110f4c9","sha1":"8c597f2a2b936c99e951104da349e99c8aea0217","sha256":"21d9c16c680d25827e69b550bc8dae34274c522e950567b602f536bc0b32bb71","sha512":"8f263d54512160e6962a13f66769eef256ac3cb5b1867ed4c7d400586445ce8875772461114ae80d261f37e082bccbd1b799709bb92b2463e98985562618d247","ssdeep":"","tlshash":"5751bf0dc809adb498c9d59d61d5d7016588bf37f1b88da8e04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.953597Z","last_seen":"2026-02-01T19:03:24.027204Z","times_seen":2,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-big-bass-splash.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-big-bass-splash.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37262\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:48 GMT\r\netag: W/\"918e-19baced3f20\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SE8SdWml8QszYNsebuHSGcjBvGQw3ibe1MbAr0ucABU4ZnZ7n7yfj1lTDjRaVUj2C6REdJJtBrh%2FOC0Hd4u5qCNLOaUFmxy0jjacE770BDvcRis%2BnkMgitg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4981bf55ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37262,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"79476b3c7ebcad28d8fdc0d5f85ad000","sha1":"8b2f1fb1ad056a0632d84f1837605a4a3e832728","sha256":"4473a8b5575d915cf44d61597db43f5d62ee7d0752124038b9e9429e470df175","sha512":"f33f2b7a81473c146ba450d2145dfa2ffee0ad7f55140f0ceaa456c82d80dce09502a0c2c9e5bf84a5d0f2b369087f1966d9194b165201c1b6e86b42c2e479d8","ssdeep":"768:q3OeVCYodyobMFV5oMjwArwfdR700bNO3z9apqzyCURBY:sg1MYMEArSlv0oq+1+","tlshash":"c3f2d0662a14ec00da0c97b054f8d5949bd307ccdba167acbdbd0e5e1fd65b4ed84142","first_seen":"2026-01-31T21:14:50.737237Z","last_seen":"2026-02-13T20:55:00.847487Z","times_seen":35,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/home/banner_blue.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/home/banner_blue.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 346328\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 28 Nov 2024 17:51:34 GMT\r\netag: W/\"548d8-19373e65070\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X0QXuohlSmyeDeTBxX1%2FAfGFxDFNPuZurLQh%2BKJEqp8K1HU8VcNAutyornlbE3Kbm6mS2kTYj5IY90dpEqbozVfCvCAz6vA6yS4hIk4J0%2FKbd4ESkMSCHiI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4993c265ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":346328,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"258caeef71fa47f5e6268b4b1a0a6b03","sha1":"7d37eb51c4d5da68acce58237e7433d88ac177a1","sha256":"7cfefd291528ea7af2958e9725c412133c8e6ce380715b5e879e36306a133057","sha512":"68aeb1ec8ab4a1dd9c203b97571f263c0610d4d27da4674a7b98b85103c7a2c717a26a69057352b40edab1cee07f433803774b52e20463e638f118233d4f33e4","ssdeep":"6144:1bWZvyoqJ0Jf5KFuuBiYo+ytRpJqIU+Q13ZVAjGbq4AfuFeVizTHRykmOYVfOE/1:1SvyTJ0LKHBiLtcIPQBZVAjGbTAfuFef","tlshash":"6a742337eff90923b01d93edec8a1f81181fe8a64f15166e5ad2d65c143cd912806b9f","first_seen":"2025-03-15T18:38:34.509263Z","last_seen":"2026-02-19T17:02:28.815656Z","times_seen":80,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/terms?_rsc=8gnju","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /terms?_rsc=8gnju HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/terms/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b5ea8534171cc2ba-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms?_rsc=8gnju\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NCwYe%2B2os9ISF6P8ZQY4WeXcwYiQVBvc6ZHhwQJYF8NmFru4eOIO5X5dR33p1WPuWyoTegVGyRazhlZupeFCPlmuW16ZFLgQler%2F6QG%2BVRO2B%2F852ThZBNg%3D\"}]}\r\ncf-ray: 9c73b49f5d325ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54193,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (4185)","md5":"f5d29ed1253e64de31f84e3b3676c41e","sha1":"b89a58ea18a99c4481229746cbe2b1dadeefc777","sha256":"261901366593145563a1bde12a6e3caa74a32941abc4565fba1b05d58f8ad5ff","sha512":"de2878ec44cb1054dad6aa03dde2907232e469337c4af8441b037a292f6cb39eb2bdfe4b5d4dcf0d3fe2c1349044eb325b0aba9a2feedbf8f37b190c8de3a496","ssdeep":"1536:Af8EDdTLe6LEOLXZX8ZxAhKjXZ4IHMbObHW1BXyv/+/1FOeKGlTx5ibdkijTFA8f:U8EDdve6LEOLXZX8ZxAhKjXZ4IsbODWS","tlshash":"cc33565ea7055bfdc9bb00b0345ec2dbe71d0678eb27ce7b65a81a250387934496b3c8","first_seen":"2026-01-31T21:17:17.908223Z","last_seen":"2026-02-01T19:03:24.031837Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/about-us?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /about-us?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-bf32fbe812217ef6-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vJsxIhqpgnXXkG11JMoBFuNIwZS2utsQEOQNRUDhnG37Sisx6jAtcU06a9yIHoxiP5qkHYfuL95JrmR3cDVRSzI0zUATmHEi0ODvimqbladDscroI0Tm7qc%3D\"}]}\r\ncf-ray: 9c73b49ffd555ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/group/slots?_rsc=bjw25","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /group/slots?_rsc=bjw25 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/group\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-af7ef2b91b490831-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots?_rsc=bjw25\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7q%2BKc8k0DRXlMqA9mObCB%2FX8E6DatjgreD6mtESPv9hL4fn2aeg2aBNits3oytzUWXTNuZMhCPwoK6sJc0JHEW7%2BjeY7WIId4H9cMaKx0JBxcerJOThP49U%3D\"}]}\r\ncf-ray: 9c73b4a18da45ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Roboto_Regular-s.p.0a2e2b47.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Roboto_Regular-s.p.0a2e2b47.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"29144-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ko2%2BLR1PgtWNGdync9XJLGyY%2BlwmsrQ%2FJT2MNieuTlyOvdNgSWnoLK5grgNWMnzTyKoMQFiIW1XuOguC2UxynICV5uv6Fob6QCLUIzALpHk8emN5uvsJPgA%3D\"}]}\r\ncf-ray: 9c73b4835f5b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":168260,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"GDEF\", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob","md5":"8a36205bd9b83e03af0591a004bc97f4","sha1":"56c5c0d38bde4c1f1549dda43db37b09c608aad3","sha256":"4e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14","sha512":"e96b43b0ca3fd7775d75a702f44cd1b0dfd325e1db317f7cba84efdf572571fe7594068f9132a937251aab8bd1f68783213677d4953aca197195fbe5db1f90d7","ssdeep":"3072:5y2goL/sAQRuzzlPrvRwhRFUzMWlYfxJVBxV+aYT3qPXI0yH4yDuNOIOU7og2NE/:xOmCeu+bqPeHr0WUMxNE/","tlshash":"83f3d601d642aa19c6d6b2787c7cb3be4c75e82dfd4a602734e5af2115c8c05ec69bbc","first_seen":"2023-04-07T15:31:36Z","last_seen":"2026-08-07T13:12:16.015222Z","times_seen":10324,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/2349889433227e69.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/2349889433227e69.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"10b33-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qo14dApm5Wi3v%2BoUeX%2FbiGjjxNhzGKXKlH81nhKm6TsLkV79gB7Qetx20F%2FnQhMWq2JX%2F5%2BPZz8avOMr%2BK23CDFtB6cCJbggpKW%2BcDmGnOcLLBntURbJVs8%3D\"}]}\r\ncf-ray: 9c73b4836f7c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68403,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (60216)","md5":"78bce7ce7acfc3881e181f458e56e281","sha1":"31b0a2cee84238768b19d60f5bbe95073f85f927","sha256":"bb5a1ecce51f1568ea7b8136da53386bf996288fcd864ec646ba176b5b858af0","sha512":"3dcc827162e8eda233878321092245d82f2eb30c1f09cbeaaedc63426ff11efef495f99064aefcb610277b3bfb0266890fe6ebcfa75ea538d8d58f5c55f1f96c","ssdeep":"768:giSpd5w4FuUe/y1xxzgxk93gtaKoYYS221frDQUkP/M6+rueVutcc9m4V:ZYAymxktgtDDQUkP/M6+ueVuZ1V","tlshash":"dc636c63324228f65bdf42c6e02e8606e33915d6900d4124f7aa5c3a5b61fe890e7f2f","first_seen":"2026-01-11T01:55:53.41201Z","last_seen":"2026-02-19T17:02:28.846589Z","times_seen":73,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-sugar-rush-1000.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-sugar-rush-1000.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31916\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:47 GMT\r\netag: W/\"7cac-19baced3b38\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w1JTS9hV7pbR775InxcegCKCko2xPVYTarrNy7Yac1kadVTCUTiwcZpdmOF8BAH4o6aI9vBHmWW%2B%2FWxZU0I2kr8v6O49OWBlJT2zQEGmzFjRA4bvD%2BvDDr4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4981bf65ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31916,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2bc91e87078c0300da2951b9fb6d3922","sha1":"be64458699d3724723f09c247fb5144bd0775219","sha256":"cf97185302d9bd237a494b97bbd8f77f16f545d342e96bee60c7d01c61e67c30","sha512":"d3121142198ee81d809f9916a7a6fd52f5da384802beaebde2c9e525d05855fe223692d573e11d23c45e30ee3694ac2a56069477fc92a5fa4c71c4a73ea37389","ssdeep":"768:SMsmgRyzmCJIrJMKiJ8YIAvxh7XiDISmNB6QkxfI05E:SMsmgS0mKiJRIAH7Xi0SUjYA05E","tlshash":"78e2e19d33aca0e8a377a461cec072a25eb29cb95327ab5c319d5f17f1587b03b0d640","first_seen":"2026-01-31T21:14:50.635658Z","last_seen":"2026-02-13T20:55:00.739006Z","times_seen":36,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/privacy?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /privacy?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a237acbc458250e5-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MOj4V8XXgDgBdfDdkJ6YSZNcs9DOVs%2FZQvJg%2FPWSOXlAtrVQZqDUixG3Wg42KMyXsNfqQG53zQU4k1QKpe5XZTTAjkGd6KeG3%2F1hIiND5Lrr%2BEmU5llVQag%3D\"}]}\r\ncf-ray: 9c73b499cc4b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-le-rapper.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-le-rapper.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14226\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:01 GMT\r\netag: W/\"3792-19baced71e8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WpEm2aIP60HwnQFclsZRkBA%2FKcREC%2FeXvSlEt6uigNjGrMDGuvJi%2BmwD6qKhRSeJb7v3uMKQzdOgf4Bf3lKAzYnAq4HBEJ4fGf6OLwa%2FfNI9KTz6yeMHZvA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c795ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14226,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 204x273, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5d093aba4e7e1d4cc39e7898aa2f699b","sha1":"36a63e849cd47e7e5761d49c19a7d9c4120488dc","sha256":"ac7195cc1ba90c1a07f551920f906e0862d092ca0b6672b37f040d7b9692a39a","sha512":"9578995b85c4c223128724b8c86046a0e0675a03eefae2cbfca5b0874bc4dc5d338cdd56cf224a600a3e73b0bf7601545cf89e54e0c13e5842c7f7b693b11f1a","ssdeep":"384:nebkD2hrDyKzLjXWOOLmwFKlVWlbs+63bpS:ebgeBzfXKCww7gbsd3Y","tlshash":"dd52bf04f42f9f8e4b88fe924aff4ce534f79a0247a5d265a106a4304636b56d60b1fa","first_seen":"2026-02-01T19:03:24.041081Z","last_seen":"2026-02-01T19:03:24.041081Z","times_seen":1,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-dream-car-urban.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-dream-car-urban.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24546\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:44 GMT\r\netag: W/\"5fe2-19baced2f80\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=srQ0iIq1FO%2FGom%2FnvDHUKj%2FNderMPIlto8gIjsZXHhdUBvT4OtPFTAMrLMoCFYNkgjBn05M%2BwraOyKsdkZU2gJ5vL3745pVXwO5S%2FE3W4pls0on3VoGPjwE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c845ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24546,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"055cd8036fad04ef2c18dc74a3fe7f92","sha1":"fae287a73b9b40851cc3e75b37df132955d8830d","sha256":"66dd796577d46481e9399c9e28171735a63721b277826b058ead7acdb1f0a344","sha512":"756ca9dc0aad44d2ae90fc72ded5676afccc3df9e5b7159a6b4d3691549374744b9bf8255830e9c9cf1a591737c3bb6051fe2e91dad5a136d642dc18d379413f","ssdeep":"384:ZP7mwAC62aU8bToxQQ2KeAP3468OswBxWNgURDGqUiEzi6nv5X0Nmr9:cwzarvcPv8O3xWt4iy57r9","tlshash":"87b2e183736ecfd79440256af3c0e5c943253bad348ba60e0ac8cd1665a45f774d53c1","first_seen":"2026-02-01T19:03:24.04328Z","last_seen":"2026-02-02T20:05:32.954635Z","times_seen":3,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/turbopack-8b7cbc757f5a124b.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/turbopack-8b7cbc757f5a124b.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"29b8-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=asokIDcNizah7rzbOHIIyP2lmADyopIcl%2FqLBzASljG3YtOIQVNeHCZH0iAdrek9nd8%2FyxFXJ61J9EguM9m8Hw7SSZVlm3i0x6AyGEqTEgb3KOhw%2B9hBcHg%3D\"}]}\r\ncf-ray: 9c73b4835f6f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10680,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6484)","md5":"bcd0b1d5248ea7beca980ad82efa6807","sha1":"ff3d78d01c42f6bcb8afa64500820e3b31dd94dc","sha256":"10f69d74fdef4854f791540887c3c947f1f50bcee1a89db478554eb66e9ced61","sha512":"84019404a81099de2ee1ba054b0603f518f19e56e97bd2d5b208acaf96af0f271d4f5a4a7f1efb9f2d63af2c42a81720283872f3a17486466c0b735848a34dd4","ssdeep":"192:3spVl08YEsUnUj5E4dn2Npl/daXMh6lW9xocxkUk1MsOR:3spVv40bl/A1UroQp","tlshash":"6322b4da33a6f073436fa1e6807f0044f17944b9145d582893aca8fa28394ae49e7f67","first_seen":"2026-01-31T21:08:57.353463Z","last_seen":"2026-02-01T19:38:23.504412Z","times_seen":40,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/b24b62029e7b77f0.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.650Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/b24b62029e7b77f0.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"620e-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hQ%2BdiZvHwXMRqdERSpPPQGan29BP8xiOlRX0piaW4qgE%2BzKwcbrPmvkk4qv92nYBKdM0GXkm1H4kqr7gw5SKnLF1vuxlRX5yO9OgzUC1J4g0DN7nCBbS2ic%3D\"}]}\r\ncf-ray: 9c73b4836f785ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25102,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (24745)","md5":"a3efa1496fb3790aa32be064c1ea58b9","sha1":"12600f977dd39b4f9ec71acdf338a52e0dce12a7","sha256":"96c4e85350af7ca6c9e95dbea100a3ea00f644aece44c0076c936e4c9f8894a9","sha512":"18140f500096bcd594c1109049ab0168549583ab1c260eba910b89ecd8d0749f2c5b7d602ad66dd153f685eadb2361e5a279ea5ec0b8da170082037711971606","ssdeep":"384:wHGENcWB9YdI5vwpLFRXkdJfWn0MfzO4uE7gj+fjK1iTCMsJ9oWuniaoJQdmAmQA:D2veRnAvfMCJ9oWuniaoJQdmAmQvSeVa","tlshash":"f6b2e8bc32117411db8710a9c0ef4d06e12e25b6220e8465b2be9caf25b5ddd50bbb7f","first_seen":"2026-01-31T21:08:57.278665Z","last_seen":"2026-02-19T17:02:28.869737Z","times_seen":71,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/home/promo1.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/home/promo1.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8944\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 21:01:32 GMT\r\netag: W/\"22f0-19b7b5d9fe0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=twzSo3j3srV4pwpGCkbAv20ho4CcaenpbBXf6NdGFHTwPsgOr3JKUgHjaJ4E%2Bw26TyxYSxHjZHWKFcfalmjGsLOuZjI%2BuTxn9sNgIJgQcGd1G4FS9aC58bQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4996c2e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8944,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2b8130a91fb4c5a77bab53ac79c0d1a4","sha1":"69d9ffa75456675f8ea57bd2e63c92c28cb9e418","sha256":"d55c522b42c801b1d691f66a300b86f5d63453f56ec6cc13eff9a4e59c680fe6","sha512":"948adc9e24f539d7318b094c262e885d65a38ea348ee8cd533c40c646be5c12adf899efb4495060dfd289687f9ce2d818474a8bcd1f055e080088348eda78575","ssdeep":"192:igWb2C6F5XTxWaehYqbPay5DmmHKMaYU2UWzqTGWAF:igWKC6HX10NbP55BRJU2UWkRW","tlshash":"c102af4fd4a89b154924b2bccae79746e00dbeb85a251f683c6cf4eef625102901cfd5","first_seen":"2026-01-11T01:55:53.489214Z","last_seen":"2026-02-19T17:02:28.760725Z","times_seen":73,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/about-us?_rsc=1gswh","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /about-us?_rsc=1gswh HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/about-us/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9d56d7854625b465-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us?_rsc=1gswh\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xrgt4zqQABUkrNzU6Ges1LZW7plbdKNQE%2Br8oq8W%2B33eDQYbcZuAy4LhcPn%2FuAJqB8oKYz6x3ZBsan0A0%2BFDcwBOnLlMAYE%2BvCpl%2Bs6MLtRwfdcTr%2BuCmlo%3D\"}]}\r\ncf-ray: 9c73b4a00d575ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19572,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (4208)","md5":"094bfef5c512dade78c9326deeef08c1","sha1":"1fe2bcad69284fafd719a94a940ec0bad86ae76d","sha256":"8e1e42bc80dd068eac300cfedc1c6b5dca7150e3f1edbcb99edcc6ca1a31bdcf","sha512":"84dc7ba813925ea4de543d05975b130a2cc5a43f17f6d8cc367f523c53a60303dd6c2608f7b73fb392a3e998527af058c01fd5a2fb0db9f63c7f10b273bdda6e","ssdeep":"384:yquERUqJNpfMFEBgcXBqi8KmAw/h6R80d:cqJNpfMFEBgcXBqi8Kmvh6R80d","tlshash":"f89201399706aeecaa3b0065142ec32ea71d8a77d796cf75e2fc9e6103460742d573c8","first_seen":"2026-01-31T21:17:17.873213Z","last_seen":"2026-02-01T19:03:24.048011Z","times_seen":2,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/09bcf53934cf48b9.css","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/09bcf53934cf48b9.css HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qDoy29JFxC5VIlE5ycocaBjUUIfo2NmBk%2BQyw7aTRqGRUlpRxm5GzVKiNB73rl8uXLMbKA5JwGTDXjGZ3LTCNBQGjdle2p62fH%2BEXwwsmbrqk7S62mLOY2I%3D\"}]}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-encoding: br\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"93-19c15989c68\"\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4835f5f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":147,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"4f335c221d5e283df96fc6b4a2e8775c","sha1":"44169cf280b27a325f85cb86c9c79f26ea4807cc","sha256":"75151e853588fa94ddadf82b7e4442554a7cfb03eb34dd45896004ffc7ea5c9f","sha512":"7683594dc8582aeb0af1fc6105d9c25c31638dce4a62cc3ef14f140bf1e4ffad6ee7b0aab3b4c613f05a575d384acf404af28b75679a66a5dcb41773640dd3cd","ssdeep":"","tlshash":"e2c002cc938927120487a6d23aa0e5e1c13ef1c1bab984cd21a9754ac3466550186646","first_seen":"2025-11-23T22:59:50.462528Z","last_seen":"2026-08-05T22:14:11.433917Z","times_seen":87,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/19b0da46175198e4.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/19b0da46175198e4.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"75b3-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2M6nk0Ck4pg22PC7qYpYP3gCWChELG1LrBAc0cPUHcO%2Fd2%2BhLoRUKvTP3wFiv%2BPA0K0dHxpK0HMcbfIeISDQxQdu3Jmn906%2FnehcBzQ%2FneFu8SXMygLFaGw%3D\"}]}\r\ncf-ray: 9c73b4836f7b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30131,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (29774)","md5":"2007ebf0b401ba67c261030cfee8e756","sha1":"e38591bbe7d137269496a20c91da35ea00581c71","sha256":"e49adb5040e39e1241fb0ec7756630b4a0bbca6dc3cb4a82abb2c15772c1b528","sha512":"7768dae710c0e0a546c9502c8b1f5e49cde8ecd56541cf9dc726ffb8f694d4f5ed2ef5e5a27e26da06936686bb3f571f39fd2c81d85589f00808cf11c3353109","ssdeep":"384:lDxQbCQlLQVt1VmIudAorv8ii9gGTHR42VqzR6l+mgebWgrw1gC:lDxQbCQlYHmIuq9zrRUElHbWgrugC","tlshash":"a5d2d690d121b8b8ac6b89eef57d801d721d1b24c71d0b25b1bb6efc13446c87e53b9a","first_seen":"2026-01-31T21:08:57.374651Z","last_seen":"2026-02-02T22:33:10.172899Z","times_seen":67,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/games/home?priority=none","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/games/home?priority=none HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-83493e22e969616e-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OUS9pSrsdlk0hAGNnXaioowWACHOh1ZppqHCPthdbVwAfY7ApfoNGv49nFFydUtonv3tKDMDf7OcfKdNAwyeIxxOlUDUGt7nyeSejuLSn0H1vDbUTPq4n54%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"3410-JNmIeLScyJBkdyghxazxaB5xLR4\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b48f3a1d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":13328,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f37feab11f2d0906ad163b94649f6c7b","sha1":"24d98878b49cc89064772821c5acf1681e712d1e","sha256":"35af18de983a7e1faa9d59f497369e71795f5bedcd3c9f563a62350805f00084","sha512":"b1a4fdf503906783f78faf9e8bdf94c4531ba69e9973a0a9d2966914ff5a0cde2d36f31092d4ec571ed2af109821876ca7d94206e2d205d34e1275015918d4d2","ssdeep":"192:Neof7taL3t5NEf8JmxEPv7a29G71GDu4AhiEIT8rj8:9azS710siCw","tlshash":"d652bfbac4954ca9435f6f0110c72d0ef4bd2e2331c81c69681aee3cd99ed97e60769b","first_seen":"2026-02-01T14:19:43.942168Z","last_seen":"2026-02-02T20:55:17.580137Z","times_seen":32,"resource_available":false,"data":null}},"time_used":687,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":639,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yv7qnfj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yv7qnfj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-80554db446251902-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iaWimk%2BI98Y0AXpEQoh73qjPE4hq2vQ6WTMpKEvNaUCa6KD76%2BB2gO1%2FQezeopDafYRxpz%2BxU5RuPlnE9G1%2FbUAWRPpeVdqZGmanoP5QNhdmF%2FCQm4Tt1zc%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: no-store\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b48f4a205ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":118,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"2b3596ec74763ccb2fdd425f481e0106","sha1":"5b7b17a6830a1a452c2d67fee2bae09114456b7b","sha256":"542d40b04fab6d37d87d97d8b19115a62a66bb3aa69da0357f840a1d50f01a0b","sha512":"160f3c2c2084a27be388357ebe4cd02eaa488caa5b2179bd7d85cbd2da56cfb429b63eb7c01602e346df2f2a317230cb829f2a7c2a2416888adf27df556b91fe","ssdeep":"","tlshash":"71b09bd4411d92c9fa61729171e3b9494d9c785e5dc944e83124048955575105125617","first_seen":"2026-02-01T19:03:24.051053Z","last_seen":"2026-02-01T19:03:24.051053Z","times_seen":1,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/web-vitals.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.840Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /ph/static/web-vitals.js?v=1.318.1 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569831%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/javascript; charset=\"utf-8\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\ncache-control: public, max-age=14400\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\ncf-cache-status: MISS\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569831%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\netag: \"697f7112-19c7\"\r\npragma: no-cache\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: script\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.71.172.81\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zNd4UbwWWKi%2FHUD2mGMrxtAAcgVc02JS9DrCdpe3j0Wl0JHtu9Dn5tQm%2BPsUfwd6X6U3NGokqevr1O3GqmHsn67gtS%2FkDcdrC9OBL47wRz0YIUtsVk%2FO2mA%3D\"}]}\r\npriority: u=3,i=?0\r\nx-middleware-rewrite: https://eu-assets.i.posthog.com/static/web-vitals.js?v=1.318.1\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding, Origin\r\nlast-modified: Sun, 01 Feb 2026 15:28:18 GMT\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncross-origin-opener-policy: same-origin\r\nx-envoy-upstream-service-time: 2\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-ray: 9c73b4917a735ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":6599,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6559)","md5":"aa1e3521e57a40ad394b049fa7ff3bc5","sha1":"ec88012f680be684d8d430c5efd61fc29b658374","sha256":"b17014672e5f28d0dc0cad40ee4d09feb6a1201dadb3932b1f3073a8e4f387d6","sha512":"729c7ed37f0f321fd1c588aab554f289ff37fce9a3cb7dfa78cb8f47db8cbacb69eb0660ea2e245a540dca857f4cf277f67f53c7d789609006e56799ce3ad282","ssdeep":"96:tzI8C48z+TJzq4L88kTAFKb5rbCKHDuqqUtl0AcJ4c0jU4mzWuCD/ZDZkRlulDsd:VC4F4Sk8FKvae0f4TcWuEZDyCSXEdij","tlshash":"eed1d9f59f41e53921bae2b6d47a514333396386a409409ce23eefd0146d4c6739bb32","first_seen":"2026-01-29T18:42:31.973098Z","last_seen":"2026-07-15T13:28:32.224646Z","times_seen":3490,"resource_available":true,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ingest/v1/web/start","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /ingest/v1/web/start HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b22d7ed6779ef3b4-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nContent-Length: 301\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":301,"data":"{\"userUUID\":null,\"projectKey\":\"hXZI8YC5XRbnxJF59UBk\",\"revID\":\"\",\"trackerVersion\":\"17.1.0\",\"isSnippet\":false,\"timestamp\":1769972570104,\"doNotRecord\":false,\"bufferDiff\":1769972570104,\"userID\":null,\"deviceMemory\":0,\"jsHeapSizeLimit\":0,\"timezone\":\"UTC+00:00\",\"assistOnly\":false,\"width\":1280,\"height\":1024}"}},"response":{"raw":"HTTP/3 502 Bad Gateway\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 6466\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9c73b4932abd5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6466,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (396)","md5":"de8a3e946aaacacd89ba503586f31046","sha1":"77e3a32e54b04e5417d06a86cc73ea98fcbf6eba","sha256":"342ce56f2b8611c6b5ec67524a089a9e2009cecd64a78bf68cbec310ac1fce5f","sha512":"ee78927020348f789225d420dac1cd1b2bbb1558f32075b4065adc6e4c1573a9d48842e21cca474c690bf01403cf8c67781acf064e0ca984b7dd11c4ea4f84a3","ssdeep":"96:1j9jwIjYjUDK/D9KUnFG4Fh8/G4Fb5b424F/+skKmtmnio7RLlNaQxP:1j9jhjYjIK/BrFeTMRVMno71lYeP","tlshash":"77d14371b1b512ba10a382923595fb5a79e0c613cbef4594b3dcc2631fdee81a943194","first_seen":"2026-02-01T19:03:24.05286Z","last_seen":"2026-02-01T19:03:24.05286Z","times_seen":1,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":114,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-might-of-ra.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-might-of-ra.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 46774\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:58 GMT\r\netag: W/\"b6b6-19baced6630\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UHTtSTiU52Z6qoHTnIPVEL7KG0z48UgHl9KNu1OhJrfHA4eNVamstrCvoboQHtmlnCKJZRhdiUZRHvHDmVJvAp024dH%2Bg8Pws3aoLSC%2F3f9zhiRbpN%2FpluY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b5c775ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46774,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a0a1497c0ebd6af28ab9097b8a859dcf","sha1":"b6d6e5b95f617a3e881e43b67cd295628961f972","sha256":"7d285500f4ed3bb4170c8ab75f1b84324f4dda78fa90ff3df6d528b629d8fa41","sha512":"7edfb0671208a4dffed6a485a6919bf1caa78633a97c152ff48a2fab142a9db6e8528a3918e55c4d809788d90b88e348ea65bd8c13574e94ee23ec522a54dadd","ssdeep":"768:t8k/7TFxyTRuiR0DcnOXExpnKv2MlVYkgtNn8vaF4UkTtk1b:t8z8TDcOXYKv2MzYkKW7p4","tlshash":"5b23022f3b74c3624655904997d873315a68b9f3d5b08dbc20d992bb6cc924854fce8b","first_seen":"2026-02-01T19:03:24.054183Z","last_seen":"2026-02-01T19:03:24.054183Z","times_seen":1,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-floating-dragon-hold-spin-megaways.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-floating-dragon-hold-spin-megaways.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32818\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:53 GMT\r\netag: W/\"8032-19baced52a8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NtkJoHftMSshHs3sW0ZAsTgDvPmu3vVfL3WdBk5fSVmTFnlq%2Fqa0hK6An6rokrseX6mM47h307eFtOHHrlVMEUSpEm%2BxZtgqoTeCFChTTlHJHYGNxmuw%2BDw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c7e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32818,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"eca54c51617d7e5592d58920e76fda3b","sha1":"258e418b4fd02194c9ba30d7429498070ff7f05b","sha256":"e6eb509ff40458d53d89d60b882d88b6989ee81713c19f3205ed04ed0b9d569c","sha512":"92f0e45522d427fad46172b2f27ab20ccdab8fb1aac4efcec99ead2b6a8aef17dbbc5445ef3e7b02fdec66d01b6bf45ae13b1a89a320ef482d302a82b07acd6f","ssdeep":"768:I2dySj0rTiCn9UYsovSt8UaxR+KVYy9xTEtZ0W4:I2dzjETi+aYsoKtL2RlnEHb4","tlshash":"2ce2f110c2426cd7a4c2896fec69bc26d0b501c346e819ca948dfeaec673d9de91dd23","first_seen":"2026-02-01T19:03:24.055251Z","last_seen":"2026-02-01T19:03:24.055251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":575,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":550,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/27b71be17762de0f.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/27b71be17762de0f.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"8205-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KNoAEc1oSx9TuIiV4qfMLpyXmoRERHsgZuxG1FeNJzSKlV%2FPMiHtSypPnFr%2FHzrkVAXP6Re2074EvDQTIV2LOPBwbPAZmk8%2FNg6c6ejRoW5YpUF1P3eWW%2Bk%3D\"}]}\r\ncf-ray: 9c73b4835f625ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33285,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19160)","md5":"4096c4d4d5ac98daec5aa8644d190e15","sha1":"eda20aa13991a67cfa896c2cb095ff2cc3eeb066","sha256":"a4e704b26094e68db8a6c959285508c57e758610aa915c4c8c38bf9f71801e62","sha512":"20bc9534196dd3654f1e511b2f8762774d5621779a3f51c4251e567ac2c2cef57ba58e1c7e9d2ef5c54b9babb5199ee2c0a475d1908a5869ab905bbf98ec0a13","ssdeep":"384:ojpSDGGRkRSrTfIVZ/X+C90mkdG4+Z47aYSwTgqGFJp:2S/8Z/X+C90fMzZ47a8sF","tlshash":"dde2b6b572d4faa2129341f0c43f2017f2684c7521ad7470a7e4cc9b765888da6bafd9","first_seen":"2026-01-11T01:55:53.408677Z","last_seen":"2026-04-28T01:10:54.33573Z","times_seen":184,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/e3b0cf32d3668e3e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/e3b0cf32d3668e3e.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"7ee3-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gecWFXY5GTjw%2Br1GvX5HZ6L4vGK0mwB4tONgCJkqChNIEQOkJ%2BvPXzkw%2FW6C1BnbpQ8BMXnlgiris2jMZwneekP%2Blr0MTgJTS5%2F5x3jRJelsKJo1j9MsKsE%3D\"}]}\r\ncf-ray: 9c73b4837f7f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32483,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32126)","md5":"4e5379c1bbfbb186f837f831921c4f13","sha1":"e3b42b23015fe4463332662702dcbdc12efd3256","sha256":"fc40324411b1ef5263ea87012729f52d443136ffc93caa8940b43297f86b0c25","sha512":"45334f3cda20eedb7c3304206c9ecda79b42979634544f7eb54ae9b6fc8ad133e9b0cbe0dcc15585f769e74d50e0bbd599f8a2b5fa43a1a3d844e250053185aa","ssdeep":"768:jouEv/zy1gk+eUNXbkX+4BNtr3kJMlDE3BkefskEJ5sa:cuqu1gk+eUVkX+W3wCDENfskEJH","tlshash":"bae2a5e63602ba73e3dd01da50b64459e37e255e2009402cf97d5cae3a78949c0ebb7b","first_seen":"2026-01-31T21:08:57.293702Z","last_seen":"2026-02-02T22:33:10.107202Z","times_seen":67,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-ultra-burn.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-ultra-burn.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40680\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:54 GMT\r\netag: W/\"9ee8-19baced5690\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dGeNA8A04MIgegTUDJ79h8tq7VyUk%2BpSPJvF4tPacphBhgSCXos2S44pnXSgKB2VIbvw7X9Fm3%2BzqWJtsC8m5jZdrqFZCegAHXPWQpNqooTo54a9hjOfx00%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497fbec5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40680,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4bacbbb67b033576ee624af3e5fae3a0","sha1":"211b0932fb8a035b3e63bf062fae6478e2fa27bb","sha256":"49f6eb82336d7c5e9a0c4de656bf8ff031f4e6bdc282fcf88e193b0260d1faba","sha512":"3bbf47f15ae371aa2f040235982ed60b58c74f0d6f4d2b27c96022237aee1ac59e50c1e8353666dd6f51c8dc512152c595339041dae15de696c284254227401c","ssdeep":"768:hUbS7O/MppjhroEma6sOMjYcUUq3u4pFGYltZRPMXwX9MUUcPxoDB:yblKpjeu6hMrUhe4pFHsEMxcZoDB","tlshash":"8903e10c3506dc00da88b5f49dffd2a1875b5d895aa4a0bfbcfd49912fe16dcae0c41a","first_seen":"2026-01-31T21:14:50.720295Z","last_seen":"2026-02-13T20:55:00.807027Z","times_seen":36,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-tree-of-riches.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-tree-of-riches.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54446\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:52 GMT\r\netag: W/\"d4ae-19baced4ec0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TQ1z9peutlITLXqU43hwISNC7CxxHnuiIVj9EAcv5rLBBDHk66KAXIBnB8oSptH1QOMOYqirA%2F%2Fvawiq%2Fi6D1OtalHL8dreCsWe43F48zbQXAnMlif%2FbFa8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c435ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54446,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"66e2de1059833c3edd8e9119090de427","sha1":"6ff6da8e21b103920706aec0287da92a6cfb6e6a","sha256":"a1319bb5574b6c2b03ba11aa5e8953ac9c86e399d5b407fd59add7c42b6d7ed8","sha512":"84b9037ce206e7fc1dea7c9ca1977d2069d7c20ac1bc1860cfdf5d5f1038fdfbf437c17ad4241cc875c64784de6150d438c5dec56aa754f8cb6f0fbc817cafcc","ssdeep":"1536:YTkpgc2kqywaCX3prya+kEdFKrQbptVC9DJi3:C+1XOX3Jya+kE3+QttE9DJq","tlshash":"363301268acb1fd01fef76a63c356d93b778c92d70566890837136ae700c261be9c835","first_seen":"2026-01-31T21:14:50.645361Z","last_seen":"2026-02-13T20:55:00.774562Z","times_seen":36,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/i/v0/e/?ip=0\u0026_=1769972578219\u0026ver=1.318.1\u0026compression=gzip-js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:58.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /ph/i/v0/e/?ip=0\u0026_=1769972578219\u0026ver=1.318.1\u0026compression=gzip-js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncontent-type: text/plain\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a349737e31939f02-0\r\nContent-Length: 1174\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:58 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fd5C59t6lnyxXrou6NSgmqOEyjhyspV%2FLQyKsbcpJbYt%2BP4f2%2ByL0rEIhUBbKnPnfrS88eI%2F4Uo3%2BDN%2F5fKC5ponp6p31I%2FikLJ%2BvJiop3PdDY4P%2Fx1QEwE%3D\"}]}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncache-control: no-cache\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\ncf-cache-status: DYNAMIC\r\norigin: https://postfinance-user-auth.com\r\npragma: no-cache\r\npriority: u=4,i=?0\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: empty\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a349737e31939f02-0\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.64.209.20\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\ncontent-encoding: br\r\nx-middleware-rewrite: https://eu.i.posthog.com/i/v0/e/?ip=0\u0026_=1769972578219\u0026ver=1.318.1\u0026compression=gzip-js\r\nvary: origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://postfinance-user-auth.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 25\r\ncf-ray: 9c73b4c5fc3d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-08-07T13:15:32.647925Z","times_seen":43661,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_SemiBold-s.p.b21f16b2.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_SemiBold-s.p.b21f16b2.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"65118-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tQsc0YBy0XEa3ytj9xxiGp3Wzs5SI426KKIDD0e9WJfrE2N7uqClO5kmuGeOJWSK%2BVCc7rOc1AO1oLaYj05VfFJ8zIxWebVxeE2vtFbKUNkRtnudnBuLDL4%3D\"}]}\r\ncf-ray: 9c73b4834f575ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":413976,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter SemiBoldRegular4.000;git-a52131595;RSMS;Inter-Semi","md5":"4d24f378e7f8656a5bccb128265a6c3d","sha1":"d48310d2f04c57af1bce0851e053be7b58b25dca","sha256":"0dc98e8aa59585394880f25ab89e6d915ad5134522e961b046ca51fad3a18255","sha512":"38b18d9786046633e4992308c88f11ca5ced325f805eb29b3000533459e85dfb6cd87655f1e285af8da22ac04722ab354dbda24667297b56cca824ef227373f1","ssdeep":"12288:SMPc0C2wQtzPziKFfAi2bNru42U5CB1c8:5hiK9AiENr/2UYc8","tlshash":"f9946b17e705d71ecd1a2d348af58bd033b9bc90b91ee24bb05a3a09dd971f00a9b5e1","first_seen":"2024-06-16T04:57:18Z","last_seen":"2026-08-05T22:14:11.453688Z","times_seen":291,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/4b73fe5a475716f9.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/4b73fe5a475716f9.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"83ae-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Et%2Fzcf7FrelhUWBMPk7R%2FEdHxHIWYwnDL%2BA6upkWwaPG4n9QKVqbEms8iPSdAl4Can%2Fpe7NzldNLjB1oWWkwyNb1Us7bDIdbIVIt45wvX9uTb70fea8sWfM%3D\"}]}\r\ncf-ray: 9c73b4836f775ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33710,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (33353)","md5":"d36b24fc99ee384e0689eef065597a6c","sha1":"8ef86b2640497083b9d8305d48babc41bec3284b","sha256":"c36e1856c14ed3099197c8082b210ea9ddc07a2a7ab4663c8b3e65d5e12dc125","sha512":"5513fdad3b32216d6a72ffef92b37ac87e5ae6ae430c25b3d1b926723eb66fd719678cb5bc560f1f17db468b1ecaa676b908676ab2e2dac079dbbacc7243c59e","ssdeep":"768:7ndxrGZTCyFcQvmOwaCHHZgKIGrBvnKgApILOHz2syklZ0:7ndxrGZTCyFcQvKaC9rgALOT2Xkli","tlshash":"f1e2fa947520ac75de2f4afd7089c412a7fc2120c9186861f2fe5cbe13d9ac97362b8d","first_seen":"2026-01-11T01:55:53.449721Z","last_seen":"2026-02-19T17:02:28.864329Z","times_seen":73,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/privacy?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.792Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /privacy?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-ad208a5ebf3da6a0-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QWU1pF0z6MRfy0i75JiRt%2FG7HfIUaDZhu50FBoBrR95pS2HZDWEa2Wg%2BLRjcXHMtlT0mGRpbpJY90OQ8h4Xl6YyfXpQXPfyVKRnzM5G5UB2OSZBL3bcVxoc%3D\"}]}\r\ncf-ray: 9c73b4912a5c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2471,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (962)","md5":"9660d42dae5584588923ddeb768ac5dd","sha1":"5bf9be9ddbbe5505c89b5e5c582a3a3150d80b2f","sha256":"dbc291196838bfa25b33d78854b9409e8000f92b1713403f95b509f624b28169","sha512":"5c2a49a67f69b9f674eef4e9ba196e67439bd26436dc245ec914b888bc3a7dd29015a20bc1f32a2a78471776962933a26f9edd94bd5ad6cd92c5216ce0e4a3bd","ssdeep":"","tlshash":"7051bf0dc849adb498c9d59d62d5d7016588bf3bf1b88da8e04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.947507Z","last_seen":"2026-02-01T19:03:24.062889Z","times_seen":2,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?type=lobby\u0026_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?type=lobby\u0026_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-946c51480e0a523f-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-nextjs-rewritten-query: type=lobby\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?type=lobby\u0026_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WrpXeDhEnR9ysB6L%2Beyaa8McmDy8wjFhHBV0WoLAsjffaiKzZZ1DAkliWxqrovXX54g3KCypn56UvbegAr9t3%2B3a2LRyHuxGll5RBnxLJ%2BY7FI7wvA7MPA4%3D\"}]}\r\ncf-ray: 9c73b4947aee5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2345,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (836)","md5":"2629d011e4832eb665d489bb192d844b","sha1":"8b2f717455b65a79a67ea9850eb981460d9f1b1a","sha256":"710aa66ba1747d8d0b9eb67008106c47ada9f6be8e7b091b48cf8975080ec629","sha512":"306ce5376dfa37f17c4dd3764f33471d3f5e7c30d78b3ab2a01f1ed7c9df69dd38b4a8992be33518b993948e1d0959d7fbd0ee0d842be50ae71438a11a8f4381","ssdeep":"","tlshash":"1941900dc909adb498c9d59971d5d70165887f37f1b88da8e04bdca4038b03d0beab87","first_seen":"2026-01-31T21:17:17.89987Z","last_seen":"2026-02-01T19:03:24.064518Z","times_seen":2,"resource_available":false,"data":null}},"time_used":433,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-sleeping-dragon.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-sleeping-dragon.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 36244\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:09 GMT\r\netag: W/\"8d94-19baced9128\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mjqmPMULtw8yal8mJgOxPhgIGEinyQUvvt0ShVbxXaldYb7SYxjZfIXvYgj4RInfBwnOfIJxT6uxbgGSRiuOODLFX7itCEeilktcyXb4TbjEBDTsNSjmbQ4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c425ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36244,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0dc198cfd9e884c3d44f602b4fbea4d5","sha1":"e227d77c14ee60a7873cd81a402f94d0aeaace39","sha256":"f0d6dcb65aebbb3e5e752cc6b5be84a2187feba22a19a9931e9ef613bc15bb05","sha512":"685f134077de498819d15fa82df9669075671df06ccffcc521bfc10f6470336ea2b49240784a11539c344c08e7095e564b8f8c11c78b470de2e8b8ee25885a2b","ssdeep":"768:vYNg7tCufURlCXg3fkXWo6R6zLVNRWlasC1v5KywqQeD4V3MEW7XkNEMusT:gNg7DUig3fkXb6R6NNRyaZ1v5jwqQC4x","tlshash":"daf2e19798db13c7b004fffac51cb3906466f45715f646ae18ba0ef16831487a37daa0","first_seen":"2026-01-31T21:14:50.632007Z","last_seen":"2026-02-13T20:55:00.83181Z","times_seen":35,"resource_available":false,"data":null}},"time_used":1138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1125,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-hockey-league-wild-match.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-hockey-league-wild-match.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33362\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:59 GMT\r\netag: W/\"8252-19baced6a18\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5lELoMHGfJfN%2FxBVImCQTPxSWSR%2BkWbLXwipPDJQ2rmmkgfY07QD3lamaiaVJzJX3vnLaFxquZEcC2rMr5PnUd4Dm6Tbo%2BTbcGWIefaGbbwvlxGpbrSKEAE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c875ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33362,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c115c9934df2afbbe43d101a5ef9c1c3","sha1":"6563004e9783cdf19c42b6132e9cd34821bbabd1","sha256":"8b7e623ddaa412769757be0f90005be8c04bda0d8cdc8b78233003b6ca32dd46","sha512":"4fcc63963c4cc4644c6429c58c00ab54978ad923a0aaac328a127757f4c80589f5153e28dd1125cb0e0a8f6945a27524d8216645d8681e39abb8c8cc1185f0d3","ssdeep":"768:Ui4jtNCZMmf+qqCzuyDW+3EqrktwEt60DhrHlZi7yAzLS:Z4jtNKVq/yi+3EakP5LczLS","tlshash":"cde2d00935008a50ca0075b869fd8253d7fbaa605e9ed24dff7c8d470f944de4c99d8b","first_seen":"2026-02-01T19:03:24.067072Z","last_seen":"2026-02-02T00:50:28.871896Z","times_seen":2,"resource_available":false,"data":null}},"time_used":563,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":544,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/d2da9e44d9ba7ccd.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/d2da9e44d9ba7ccd.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"9f24-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qUJcqcb8F9VxtROAObXtNmkytLb9hrLb0dfjrm5izvtGpl3P9g3e6LsLAfd5cbPKa2I%2FKZR%2BOQLqMqsZny%2BSBxXGs1hbUrZvALB3YPUX3u10ArrOI%2BAsORE%3D\"}]}\r\ncf-ray: 9c73b4838f8c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40740,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (40383)","md5":"25632652a91d344165f56eaa4b8abf64","sha1":"dca754237017683fddb1ab6d2d7cb3f6b432883b","sha256":"0266885bddc7f8cb4545a8ba58432193c0ea7d157f97c24806614a1e752a3eba","sha512":"c9d3a8b0252a7e1e710444e2ccf94bbf6e4f859549d9c650bd26ba8508e86e8a936cab7c5a6be2d3f39a5442a4abb60a8c71c64a5fd09f0b3794fbee4d2907fc","ssdeep":"768:8Aco3d/bYvcIF52OZSSQcn26fGSxqoyFtwYoF5cPpT96eOmK20:8edYU6fT2WqdtkcPph9K5","tlshash":"e303b669d35063bcadc543b056265070354e15af30ead37897aac4a0b6d30ecd2af8ef","first_seen":"2026-01-31T21:08:57.261687Z","last_seen":"2026-02-19T17:02:28.713748Z","times_seen":71,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/8d97a31a2b7bb52b.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/8d97a31a2b7bb52b.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"c2b2-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BWL0zFEXnSSAwJ9xQ0jEhmvADn7Rmk6YV%2FG1gnKZsXIU2EbIoz49Gucz8mdnacRaJl0NPrCW%2FjtlgdpKWbLMWPZvrpQO%2FwQx7n39G6vPPoA13wxz1XsBK8U%3D\"}]}\r\ncf-ray: 9c73b4838f8e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49842,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (49485)","md5":"7a6782562784798052f56f3f546edd76","sha1":"5ca984010f470a582d3d61937aa02edd1f2895cc","sha256":"eff3ee36a789baceced46592cfdf60b6b5c83bf5d7031b9e7789b45ba2e99314","sha512":"cd75a77848a365e4580e7897c2c9f6ce89280556a892969406e4219da7dac8e1d56ddb9578ed3b04593af3ba8a141294203fcc2a3366261d661ede7ac6ee41f8","ssdeep":"768:0VfQIsNtn3lErrOfQHL099txV8zlutf8uTpfQlTWH228qz9x/:kQXxSrS9LV8s8u9QIl","tlshash":"6e237484b7a5b02947a25191045b544bf278f938a4cc18acf360e4f628baddad4fff74","first_seen":"2026-01-11T01:55:53.523305Z","last_seen":"2026-02-19T17:02:28.656397Z","times_seen":73,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/39b6de55b9371bf3.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/39b6de55b9371bf3.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"8533-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BTqTSn4ZFbmunxcfX6E%2BHqUQt8Fy9kgpdiAJhPupc%2F9LNBEVZUIWxmstfq%2Fg31564WktlrHyk%2B04vx4NY20npVbszx2NO2SfyBPwOG0ZnvRJadUekPr0wN8%3D\"}]}\r\ncf-ray: 9c73b483bfaa5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34099,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (33742)","md5":"7e2dc4e87b73f4b6aab56debbfebf935","sha1":"a834e2263922aaa560d0191e13557ca7aa738bcd","sha256":"03e189bd9bbb896bc2e6bd24457db1a19881a3461921f362e3e17d024d198962","sha512":"0455ea832815815a7ab41cbb6855a12536e6eb18c9da16f650c4c005792c5b309e448f26a77ba6caf7e45b57a4e3fdd9d03cd84417abc8db3bff57970801bbc1","ssdeep":"768:dM5CSKw6XkoNCarvCYbvp1xEuiLJVgQinHTiv:dy+q4vp1xUis","tlshash":"22e2a2259550aafca93b04b5f57dd04c302dbedcce5a8b68b27abc664a514c03e42f87","first_seen":"2026-01-31T21:08:57.232883Z","last_seen":"2026-02-19T17:02:28.837927Z","times_seen":71,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/vip?_rsc=1ih18","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /vip?_rsc=1ih18 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/vip\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a63be8b4d7b2b687-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip?_rsc=1ih18\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f5w63IemqBye%2F8vEA0p10gFV9hGGGRcx89gtU%2BPKVw4IlUhelEzW10%2F6VwfJZ8FpwmqTpa86dy0R4Ak9mCidGzUAsCO9TRSpy2FELiIkxEQlv4EfymytZ6U%3D\"}]}\r\ncf-ray: 9c73b4a0dd805ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/70c45d6675f019b3.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/70c45d6675f019b3.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"7a59-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I5Jb3F5OiJKLO%2BMs5ICrfzFBK9o4CUqAwAdf6QkJUbazrbHT4KrLR4irWXhJU7HRSlur%2BuFFEVh4NcTxeROvZVcxB4wFuPKt2HMmGWxXnmZjIPXCUnO2x%2FQ%3D\"}]}\r\ncf-ray: 9c73b4835f695ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31321,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (30964)","md5":"109dedfa8a9df629754107a4360cbed2","sha1":"dca0b5125582597623dd7a5f137bb172eacebd4b","sha256":"66937c36d62b42f9c0de04ed3961be40fff3bca6a84a6e8675ccf6bcb7bcb244","sha512":"75917cbf7e84472836f0f36f0d6204002de0ef185d062a67a4160f39b8165bcdb07ed964ccf923f78e9a4bec22cbda7fd444445695eb1f68f809df6d0d9a2def","ssdeep":"384:I+FjjzUO4kzleEPQKKUdoxUCHSWiDp1NpTLTJJQrtgG40/H5JiereqeCEYjYvbxI:I8jkO4YlMsdpCzifNpTByEqrddwR4","tlshash":"96e294a971d5f4910ba354b5803f500bf23e0c76296da0f4e3a2cdf9b9a055ed132f9a","first_seen":"2026-01-11T01:55:53.490165Z","last_seen":"2026-02-19T17:02:28.781185Z","times_seen":96,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/f481d12fa6115376.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/f481d12fa6115376.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"46ac-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AVle9OWznHg1%2BCj%2BRJfGvxArHPywvwzAPY1%2F1jRaBuREpHxArBE5jKpfIFPg8LXdd%2BE6A3sJlu3Tr0lAxu9V%2F4U1PlYU4kKwhAtQ8ZD5Ys7d8GGdDH3jjIA%3D\"}]}\r\ncf-ray: 9c73b4837f835ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18092,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (17735)","md5":"c4e41c714da5a9df953f2bc887a8be30","sha1":"23b51314442a5d523c045f83e46a8cf27ac8b29b","sha256":"f14145c9cbd9eb49621d7bae4751666c8256d371c32bec3bec537995e913b579","sha512":"a42dc09d57cd64f5b8156cac5a68d4b1f2555eb2021d6fe69bc1b1994547cec0e952745f5ebfaaa6f316f3fb3dc05c8fc82999b496523dc791d4c47875c3af2a","ssdeep":"192:F4SCYqp/cVReSok7GCaTBoypywK89KkKlVqxs9VSi1zPLSGDQma7oZLrBBBZr+c3:F4SU9IReSmoy88vSMAzNNdH/Rx/","tlshash":"be821bb52b54f470e2fe81dec1270829673f3b1e210a5435f17f8ced3924a627256ba9","first_seen":"2026-01-11T01:55:53.525125Z","last_seen":"2026-02-19T17:02:28.607716Z","times_seen":73,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/c99dd6f2193578ac.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/c99dd6f2193578ac.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"5e51-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Um21Xdfd0K3o89vJAUbiZCYNzIkldrqf8YHuKPfYHDEiSpejrs9PCHD19u1%2FS1kNA%2B4MSWjN54Ty1%2BLwzDhNZi7WFfGgmnk960saryQfr0ujk%2BYTbvdaUuM%3D\"}]}\r\ncf-ray: 9c73b4837f845ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24145,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (23788)","md5":"5eabe5602d90013fa15f85a6fc6f890a","sha1":"2312e373488bdcd197a5189f2d76f272fb825fb8","sha256":"815a58522bb2f49c1bce5d54f1aec6e5c9c4fc41979d178e73397fdf65be846b","sha512":"e6d61874e6296af415a21d9c062c2657b051412569585b0aef4f2179d2d603fe640df9d8fe39b66a404d803fca621bf673ff3fe9d7ddd6cfb92a5f50852a4f6c","ssdeep":"384:N3+WOa/L3dxIv57SwaJAHTMYGeDFp3TXLvA3oLgxINGug/LecP+nZYr+gbYchU9R:IeOTMYGe5hjvN3IecGnernGmQFUM","tlshash":"92b2e9d9b361b06b53ab61da403f0405e2fea974251d096ce754d4c3b8b8ea990f7f38","first_seen":"2026-01-11T01:55:53.456823Z","last_seen":"2026-02-19T17:02:28.729415Z","times_seen":73,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=14fp1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=14fp1 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_index\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-8c73c587bbfa206c-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=14fp1\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XgzUcJjEkGBV2ublwJqmvi5un5oSnOxHr3Oz00cOHyvT0CZwAZZSMSAwX%2B3FzoDz2Ypfj8wzzNCou%2BehKkBNwIHo6KR9x0l%2BsRW1KWjscItSbvG%2B99n9%2BdY%3D\"}]}\r\ncf-ray: 9c73b4951b395ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3448,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (2946)","md5":"83a291f0cd9e53800d3716e4a2666427","sha1":"b55c49cf134f24d61584f24713a4c174360bcc0a","sha256":"98413554772af70f7cecfce5f5c90125b5cf1cc27f61776681c4596ccccdb267","sha512":"76bfde39f701c4a64db51b649a0dcceed5634ff8120cd5f8a13bab91fc009dbeec34c4225588b35872d6f9e880dfcdc63861a94803773fda24b0c25acd0aa5a3","ssdeep":"","tlshash":"c661327e120aff6c6a2b054c545ec32a635d8a36f7768e76e2fd8d72034a0245b872c0","first_seen":"2026-01-31T21:08:57.201017Z","last_seen":"2026-02-01T19:38:23.405245Z","times_seen":36,"resource_available":false,"data":null}},"time_used":1340,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1340,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-jokers-jewels-cash.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-jokers-jewels-cash.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 39008\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:53 GMT\r\netag: W/\"9860-19baced52a8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D6mA0mDrI%2BXi6%2B2%2FBNOl4VMtn1ybQHEMjamYcCEKiSnpzu3M9eTbfLXLM%2F0VNZylI6Z%2BcM9v9CzwQYXS7ip2N21yxXnY8V7hC3Iu4NrrqNQ%2Fb1AguEIOCWU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4981bf45ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39008,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bc651631da571445ec5e9569e3ed7a6f","sha1":"53c123515af196073e93d99c5815aef205d7be69","sha256":"74177a88360ae8648bfa66be932ee173c36f7c79fc2bbc83d9c63e9b37072a35","sha512":"284c2e80bea179a21d5a13760e81862caf95141ce320c096b4aa2dc395bb69da9d9104a59b8fc9323d7c4c51e3e2109be52a34c2207db0ae459d2d57ab91a8fc","ssdeep":"768:JKcA+XzmJTyVzpZCU0fMEj6f3XNt6WJBTDSfzHCKYg5iAct3jX8NP:JKv+aJ+pZCUZP36WPTOHCB3jQ","tlshash":"c703f1da60e32b47ead09139584f9d44bc4e1997804caabe48ee15d0cbc8827dbf4d5f","first_seen":"2026-01-31T21:14:50.727808Z","last_seen":"2026-02-13T20:55:00.812381Z","times_seen":35,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-lokis-riches.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-lokis-riches.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 36680\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:50 GMT\r\netag: W/\"8f48-19baced46f0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i3uTIdQzZT0UUwLUUNvB%2BuyZAMeyjsak4qw8GyUycH7qUBM9n5zAlJhrHUWosr%2FcnKt95jV%2Fg9o9Qz6M7alUwm2crw76ZwCM37qLAWBCp8BUaVkde4bESLo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b8c8d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36680,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6d49ac5e972bc77ddbe732abf50d7a3f","sha1":"3396fa519a755b343db93c830a90913726b41af7","sha256":"4bd2b5399cac9319eaf9a968e52494b88a7e5d015334bf00f8d899e35cd05670","sha512":"801fa8075dcfc007a3de806ac32cb5deae7ba4369ebb2cfe31251d0afee2bb3b4e1c69ba7107c076d8324c1d27abd955a9f8e3eab36773af6f31d13c4d607352","ssdeep":"768:+ZOrb1bya6HTsefKlTgh+aVCh8egvPmZWqqDq:AoAvzsHJgfDGKDq","tlshash":"e3f2d000b5198140eb841578d2fccea5a6e35dd0cecce228fd6eea0b0f50ef9dda9165","first_seen":"2026-02-01T19:03:24.075816Z","last_seen":"2026-02-01T19:03:24.075816Z","times_seen":1,"resource_available":false,"data":null}},"time_used":583,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":566,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/a7c7a8fadd85f653.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/a7c7a8fadd85f653.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"3128-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VkAjexQnTKOJlQ5cXxDj5W0DhKMVotrzHrc2S%2B8jzxnHwl%2Brwm7e5boIn9hKE%2FLKtWgIXf7OQRjv%2FNsJsImXosp13RGV9vklqJIDSJikwAZksYilvY4O4vw%3D\"}]}\r\ncf-ray: 9c73b49b8c915ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12584,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (12227)","md5":"6736d35e645199d0fbb2c26ff1a4c4f6","sha1":"330babe7ad7a1a008df4fbfcc4aa2022ea5216a0","sha256":"a6c5341275522eea933fa0b30bbd42b98d1d5e1cf7db03c462ec5256d35523b2","sha512":"28bed02c6ff5722134d2315615d52efb1c3a29ffa7bb4da160554f9a7433ffbfb879ce9d3c2da0d6a67a42b3ad8476e0253814cf7aa8dd3197fbf256900127e8","ssdeep":"192:GL4RE0SZ4r+zeLhVbzB44ZdLIx+7TFnRA88KlWOfSeLzt:QOr+E5ZdkxGBnRA8flWOfSeLh","tlshash":"ed42c9546154aeece5bb00d1f82f810d312f3f98c60f8870b9bca8b91a645d43b56fda","first_seen":"2026-01-31T21:08:57.356712Z","last_seen":"2026-02-19T17:02:28.855421Z","times_seen":71,"resource_available":true,"data":null}},"time_used":576,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":576,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/blog?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /blog?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-803ba091f0d1733d-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1U%2F7b8vySxGCZsYKPjTP0qEW1D4EcOfmjWsA1kVzM4DbhVKt2CaiGa17SRO042Lyv%2Fv1tA%2F11fWh2J9zSVv%2BMgDIkPpxipXzYtryrvx8BRhhTTKLN0VLrmc%3D\"}]}\r\ncf-ray: 9c73b49f5d335ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/4c6af75a4d489639.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/4c6af75a4d489639.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"d7a-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uJCIJeAYBBE88MsU36Ty0zdMpWe2VOJhvEfpKXX%2Bpbsz6okVn%2FWpb%2FEh9t%2FJbiZy2AOOqt2whBUEYysgjmEtclluNhQ%2FFFnPFADTvlGz0hApU7wlvX74tgc%3D\"}]}\r\ncf-ray: 9c73b4838f8d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3450,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (3093)","md5":"c1ffd2810057714d095867acc45f47ef","sha1":"6eceedd6553cf3063278c27de1aee25bb0667c36","sha256":"9604e0e5b4711c50c013e5c92da26573dfb72ae0ec3b83cb53ed75ea761a2d4c","sha512":"d913954244730850117b7c5363093e05714597040db3655885e941baf6cf66fde9ff661a6b0d1d0c9f8397e67197b0c0b7a725e1f85142d9d8e1ece11a25efcf","ssdeep":"","tlshash":"6a6101b6239433bab4c00fa442e6702611f53a6b30cf5174dbab4588fc55ceb907a55b","first_seen":"2026-01-11T01:55:53.535061Z","last_seen":"2026-02-02T22:33:10.184641Z","times_seen":69,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/c9f15bcd9a791bc0.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/c9f15bcd9a791bc0.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"2e8c8-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oWXTRVU7xZg5PslX0HOXmHdXseU8nbLFk79bUtUPEgVlaznLvbHBTh%2BrtuHKY6SXJwVzBLZxk3x%2Fu9iYallhg7XZchOidfkU9VQRmJavYo2YNZZp1q6A2Uw%3D\"}]}\r\ncf-ray: 9c73b4839f985ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":190664,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4de9978e77d00d8cd28e36ff13131e3e","sha1":"d3ba7372f49985df035daa52f1370b259ce034b3","sha256":"007118ad820ebb4087eda4f3427a2889e8a3fb728f84788df294b446305a9d2b","sha512":"ec0baf6adc87fb54978a75f0ac7a8be5451e8dbb6a031a8093f2f50f33d4e39711bf68487f1339120291ceb9ad6c9ae517dfa08b8162f10422dea4a1396dc717","ssdeep":"1536:WaJXdN0DtUF5R9lLviT242a/AHmPWbIsbXN3VQTWA6qp56+e7XlUMOneXKRZ54hx:j0DCdB4t4HgYbPKRT3CPT","tlshash":"4814c6b5a0616ffdfa6f04a5b02ec40cb21d1fe8c74f89a6f6bc3c6116440846ba67d5","first_seen":"2026-01-31T21:08:57.173027Z","last_seen":"2026-02-02T22:33:10.125714Z","times_seen":67,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/dead-clicks-autocapture.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /ph/static/dead-clicks-autocapture.js?v=1.318.1 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/javascript; charset=\"utf-8\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\ncache-control: public, max-age=14400\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\ncf-cache-status: MISS\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\netag: \"697f7115-3303\"\r\npragma: no-cache\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: script\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 104.23.239.59\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XchoToIQwrqv4oi3nMtxzh3lOCTT1VuO9c1f2f%2Fl9EMRebTbEGkwoqz7gT5QZI2KXyqTPSEs%2Be19SKIl2PCLXV%2FtDjJSv3Se1Ek4nICXmyqFV8ypD5FVw%2Bc%3D\"}]}\r\npriority: u=3,i=?0\r\nx-middleware-rewrite: https://eu-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.318.1\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding, Origin\r\nlast-modified: Sun, 01 Feb 2026 15:28:21 GMT\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncross-origin-opener-policy: same-origin\r\nx-envoy-upstream-service-time: 3\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-ray: 9c73b4917a6e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":13059,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13006)","md5":"cc981e3687edce8a3d22380972ee45e3","sha1":"1955fa562b42c9f134b62e7ac0e9c11bbfa4da75","sha256":"a40d91c2014cca52defeb2481998498f02fc53526fd05302df0e0e490173814a","sha512":"2dc021b1b3ef375290f2d59d97ccc6bd6306aa4af2791c6cc29a129b50acc89a0566e5b27074037312082f55966c0bda2d77ab2ace32ad4a2154d08176e1c2c1","ssdeep":"384:sw+VM/tkSeCRi2WzHiAOjCQBgxjOJWgikn26FT:n+D9QeOMgM6FT","tlshash":"69420a88b7d0f3b12bd7145ac4bf1702f03525082556c824b159ecdab4adb1622bbe7f","first_seen":"2026-01-12T11:07:28.642714Z","last_seen":"2026-07-19T05:49:44.303002Z","times_seen":5178,"resource_available":true,"data":null}},"time_used":342,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-ba46eb412d8f86ed-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b1jjw0Wa%2Bm8gcJqL9%2FCjo46sX4ERHiIH9oNQhQMrM46wPdQMmABZ90tX713qmrB9pUQ287P0Y%2FQFAJ8u2FbXTVFjvfHOhgQGVEdwFlNj0vO6MFIvYe59QnU%3D\"}]}\r\ncf-ray: 9c73b492aaaf5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2345,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (836)","md5":"2629d011e4832eb665d489bb192d844b","sha1":"8b2f717455b65a79a67ea9850eb981460d9f1b1a","sha256":"710aa66ba1747d8d0b9eb67008106c47ada9f6be8e7b091b48cf8975080ec629","sha512":"306ce5376dfa37f17c4dd3764f33471d3f5e7c30d78b3ab2a01f1ed7c9df69dd38b4a8992be33518b993948e1d0959d7fbd0ee0d842be50ae71438a11a8f4381","ssdeep":"","tlshash":"1941900dc909adb498c9d59971d5d70165887f37f1b88da8e04bdca4038b03d0beab87","first_seen":"2026-01-31T21:17:17.89987Z","last_seen":"2026-02-01T19:03:24.064518Z","times_seen":2,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-gates-of-olympus-1000.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.903Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-gates-of-olympus-1000.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 39160\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:42 GMT\r\netag: W/\"98f8-19baced27b0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=awT8pR5%2FPZ9glZGF%2FUM63GdzMpZmQ7cFixiyKPG2YTOfw2zTj0tHakKxtBcofOeuMPMkZSQciJW2u4YEF4aNWXZe4ZDa3Uotdh0cqa5TW4UI7JjGGF%2Fg%2BpQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4982bf85ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39160,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9ae88cbd6f924f3d0366dd7c24a5e3ec","sha1":"447ea415b780517d29038ba887324f05e57a9d01","sha256":"894b3de1be641f49f9ec6c54d09ef8c02ae747b40faf0f2f0919a3904e46f925","sha512":"6cf4b1d257b988fe55a0b8a0d1468962bb5da9c97b02e2ec3f4b54451314e8b6ed360dc32e3b9554250b8a19609f208ff9f74ee51f8b7d4a51b9a3b02a19b441","ssdeep":"768:iGqzoM1cgOuMNxOWxma/EPgDmGB/z1PsStoxjeRwFqd3dCh6IMZsY0:h+pO7dwaNDmQ5Pno9YwFEQjY0","tlshash":"ba03010327c692588353cbba0d5e28f4d042af423b905db776882375c27b69eafd1c2d","first_seen":"2026-01-31T21:14:50.710691Z","last_seen":"2026-02-13T20:55:00.768986Z","times_seen":35,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/home/promo3.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/home/promo3.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7782\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 21:01:33 GMT\r\netag: W/\"1e66-19b7b5da3c8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bn1vyYTMyE9UjtNU2YUc8VOR2rlgMdl2pup3R7iYUoJAWAhUxUf25t2ux7ANWPw2q%2FlYOMEraLJFdJaL3IdGZnULxaBpzTxXNpGi2FqsqfWiUlfXH4pNbF4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4997c325ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7782,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ede4c081b4631f67918ea29b84df3ebb","sha1":"419615db1061840c37e5bc5bf4081947bd5148bd","sha256":"33b256735e64989f6fcd5d28bf295e6e6d47ece66be5b9a43a96074166d74a78","sha512":"8b15972f0e61d08d22fe0dd6be6ac61b42f39d96a6f620ab8c85df5040f636f738bc9313c8614387020be54106d78fd715410ffe63db26f748b68ed3edf80e2c","ssdeep":"192:jRgHZlmBzag9JWBreRAFQZBSRyU3LZvjE:jRBzagqdyPSEU3FE","tlshash":"43f1ae7c0696320e81a9c82159f0b0fd0a993607cb42435cddecbacf2e99f4851c1216","first_seen":"2026-01-11T01:55:53.533126Z","last_seen":"2026-02-19T17:02:28.691621Z","times_seen":73,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-time-spinners.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-time-spinners.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32698\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:58 GMT\r\netag: W/\"7fba-19baced6630\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vGHZFh7%2BBzLeqjAtb1Jp2FmHrvYTZkYMnxoO8oJlnI8gd29Ont41Qpblj6yU1zCgQqnCP4Hm%2Fr4cVwAGtl%2F2lcfg8jee9OckU%2BixbDE1lbxGq6gM19JerZ0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b4c705ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32698,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b8e5abaf53c654f85752c5c75915e476","sha1":"dd9032e5d1f6b1693c63f087ff350248ce27bafd","sha256":"a644da0f48b5b39f8377cc0b3453fef82de997a9d5499ff3a6b6a53d613dd2b9","sha512":"64cc70a65b7a6e90fd8e802a2eebc2a642d23b15f985b9428f82159be76dc2d72c11c7201ebac6610e3eb661601a7d01b0ba2e8593851915fd42798299f07b4a","ssdeep":"768:BLvrYELDQUSSVwlhu1ZiqNfisnVlq/7vKDN9VjVIk9DMC492lWvkvW:BLzPLD17w70lNVTq/LYnuL92lWvCW","tlshash":"ece2f2c5a6074934d09427f0519699b8cbf9ebaf8b44c9424a28bbcfbb500892337cf5","first_seen":"2026-02-01T19:03:24.083848Z","last_seen":"2026-02-02T02:00:02.543695Z","times_seen":2,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/blog?_rsc=i47fk","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /blog?_rsc=i47fk HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/blog\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-95f7a8e411626e56-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog?_rsc=i47fk\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ynrStk%2B5J6T83prFagGjKxhdflk%2BkWcNUx57yQP0wQNpZXP%2F5SOOB%2F1jPio8tPeDg4SZ7hIxprkP20436ZPQpbBMcVAG6rbfd%2BAY6gcqDG3fgtkPGivzJvk%3D\"}]}\r\ncf-ray: 9c73b49f6d365ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/DMSans_Medium-s.p.4f631073.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/DMSans_Medium-s.p.4f631073.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"dc3c-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7SRW5ovI1ucBaySYEACaV6BxmXa8QwovIiObege5qi9IKBsLagoG6sYOPOj5ikvkBpzGRA%2BIifJThG%2F08SAFpl26Fz9kmYxrINKFPDE8SznnEnoWX6OHGoo%3D\"}]}\r\ncf-ray: 9c73b4834f505ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56380,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 44 names, Microsoft, language 0x409","md5":"6244219cea1110e6ec49e950f070acf8","sha1":"00ea5b83c109e751b844413d32e21b7689bf786d","sha256":"32c8fe1874433bd34674ef1b58037fdb7d1b245d5844076c76c6f3a2c69d6840","sha512":"151abea1c586541b2ee6fdbffea8dc7046027b37599092acba6a6a89873501ac3cd2f459a58df5be30b677bc252b4031fc4c9b4e9b5649a30786682c28243bbe","ssdeep":"768:ejiwYeGvU7ifzsu/ma5tBMPxmMu4mjtpg9IfypSe59QQZayKRgJDE/T+:ejD7eQ8dGZm14/m059QQo1RgJDEy","tlshash":"bf435d42f7158a0dd2836ebc846383f4b777fc34fea2839b5179ab2aed490a14c11384","first_seen":"2023-11-01T17:45:54Z","last_seen":"2026-08-06T06:53:38.642004Z","times_seen":462,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_ExtraBold-s.p.331e95b9.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_ExtraBold-s.p.331e95b9.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"659e4-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oq3BZVWllNoDguD5rvWZ6oJAsJ7ibeu%2FKtvvhnw0FNiNPC2EYZqMLREGxqgwRWe5rBdWwAC3ID2xErKARMvZOtBuE1uIaCISb87b6tfYGxil8A0KDTkx2uM%3D\"}]}\r\ncf-ray: 9c73b4834f545ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":416228,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraBoldRegular4.000;git-a52131595;RSMS;Inter-Ext","md5":"5061bd7701b1b3339f0c80e69a2136e4","sha1":"4a028f1fa4dbd6b4bfbfeec4a5b5e222a005b563","sha256":"3c13487b8f2eba0a78cad4cefd19272b0f4e53d61c223e6b266ddf0b332e9f1c","sha512":"65875f9f205cd70d2e1b86fbda2ac8875637e0b3e0bb37ade9da20717b0f17d2108a0cf2aa1b246affd73bea233b510d37d13193801d94e5148d3ec4159653dc","ssdeep":"6144:3VpTx/VCC2wfBsJWPziKSQVE58IqsfnHGR4tGX5/2nHTAl84RSnj3k4yhT18:3Vp+C2wfBDPziK+4suO49lfR98","tlshash":"38946b23e706db0ecd1a1d3486f5cbd037babca1792ad24bb0593a19cc931f41aa71d5","first_seen":"2025-03-15T18:38:34.528748Z","last_seen":"2026-07-30T14:11:56.974328Z","times_seen":224,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/3465237cc8e84745.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/3465237cc8e84745.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"ba7-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M4uRTWV4jHiIuyWcAXA%2Fyckd7UtzoxyLqso%2FSknjp5zKDuoyTHXMvSJPsiK5Ms1mR%2FZGG1t7fakYiwcHYD%2FohtuevKc66dX%2BdpHU58z21gK%2B%2BI3lAc%2BFqys%3D\"}]}\r\ncf-ray: 9c73b483afa35ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2983,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2626)","md5":"cc39cb431a244f75298698659afec399","sha1":"88501cb3d254828dc153ff1c2af7dfc69c4ce899","sha256":"38ea9a18386586235e62c34bd4ab179c7ce02c5adf8ee2508ce39d9be127dcc2","sha512":"120270598777cc4593a0da34f67359cdb620773654691dfc116e7613bc04e408c107c3bbfb50daeeb50e71239b5bc09e285b12d8b4164e909c328d734d6ef667","ssdeep":"","tlshash":"c5510f947251daecf52b00fce13e401e225c2ea1831e4a79f6bc7db41a104f46e89bce","first_seen":"2026-01-31T21:08:57.364366Z","last_seen":"2026-02-02T22:33:10.133647Z","times_seen":67,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/iron3.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/iron3.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5774\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:08 GMT\r\netag: W/\"168e-1930f23d9a0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6i0LA0pJ3ltPUj9vbjyapdD6D7%2Bdssj0CZJawuZTVK0JZM53ff9IigrgUhTBvVDr25AgHJQcB%2BHDYIEzQFNvW59IjUwi5kXseAAGdnyTj7aip24%2FzP3A3Bs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c865ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5774,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"955d2b7cae2f7491740579547434242a","sha1":"80c1b7282b04195f86c2784187f74e5b4bd6aeb0","sha256":"43a7361a8457eb511a4d802cd5adf58562b7c32540be6f82c181de383dddd104","sha512":"93c07b8cea44b602bed8c2187fed9101f5fa097c86b604053fc15b154dd8a85a420e636ec5f933aaec2f297cbf9c28f145e4e53809f03fd2dd79def36347cdd4","ssdeep":"96:tjeOf8aj8U0lC51ah89a++msiAFv5oZvW+7VJR/UijaHE4W1ArP40HxV3FRkX8py:rh8U09WD+48kvWuX9ahWQVVOs7Kz","tlshash":"e3c19f3d0a1562f009dd506f4df8692f48e8cc95fe15779655f20f696080e91532ccb1","first_seen":"2026-01-11T01:55:53.434029Z","last_seen":"2026-02-13T04:13:07.592614Z","times_seen":45,"resource_available":false,"data":null}},"time_used":518,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/75ff833e87438807.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/75ff833e87438807.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"25f4-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QnfSVwTmNC0SJCeJOiifHYgUs3ntxbWIdIXh3rRfhVicCpjydt9zdxPal%2FHesHKzCUsJ1OoAGbOnr0EQHIUtHA0kaG%2FBOMKNC%2B3DBpCO0HIb2KzBGuN%2BWtI%3D\"}]}\r\ncf-ray: 9c73b4838f8f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9716,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (9359)","md5":"59109722d30768ce9fba15afdeeca226","sha1":"a26518ebc95101c364cc8a9ff07f5d0f9e6e2a38","sha256":"c08ded8f72c595eae08a2471266cc35e1e9a8a0ea67a8f7faa4a19a6af15d662","sha512":"f85734e896da6467182958b85d3520c89137ec0a619145f5463e8227e018038412bcee216ff1cda9b2600155a91aa26dd5c2a868e0d4ad9578d7e7c5c061329b","ssdeep":"192:Qw1Z0+ej0y+9HYgN7V98SLnm4tpQrWASL:QmZ0+ej0ymT/8STm+Gy","tlshash":"a7123124e2bc513d689502e495274023279e817f738b517ac99ecab0b68787cd793cea","first_seen":"2026-01-31T21:08:57.270105Z","last_seen":"2026-02-19T17:02:28.738687Z","times_seen":94,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/bc00dbd968053a62.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/bc00dbd968053a62.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"107fb-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KO1wEy9I51GmBM986%2BI6C0AQ7lU2WO5oW5S3D6EM9kJ9rQAPY54h4Kv5tD0BweL7wueSEPO84zPkkfPA%2FFo0q%2BJEStZ47f3whpItdfjfapJAoKubuBHunzU%3D\"}]}\r\ncf-ray: 9c73b4838f925ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67579,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"54063eb7b6a4e8845b7b5621d59393f2","sha1":"1dd66c0341da2e2046839b93e596e940817f6422","sha256":"c1bf519ba156ca7fb4bfed64075ee0b668cc32cce0f8a00f4ce720371dee3bc7","sha512":"07eb929ac5488c8b066a963b55d92a1d4146f1f6ebfc87e977e602a7faa1c8943511f3c785b04d6e0aad2e89d14d567e6d641a9cd476de66590be4d7d2248a49","ssdeep":"768:e6OHRgDFZ92YskdtAO/rx4soJY0W07sXlAa7Kht+DLN1AbgnnqD+hH:HOHRgDFZc4tAsv0h62gL39nqa1","tlshash":"bc632ae63351b462d3db5196c4ae8501a27a59e4240c083c75fdddeb3822c8962fbf7e","first_seen":"2026-01-11T01:55:53.442527Z","last_seen":"2026-02-19T17:02:28.647339Z","times_seen":73,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/DMSans_Bold-s.p.8bea84e5.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/DMSans_Bold-s.p.8bea84e5.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"dbd0-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E6YVjvzbdXwlwxgIyuLEXkfoQrYP%2BwyHGKLgDBzlvwmTq%2BAiqqf3Uqqg%2BQesFJMrCtBO8QlJ0h1FLSqp3Y7PqflujbE1z%2FE9R4vWsP%2FIt8ZavZlQhoQdFqY%3D\"}]}\r\ncf-ray: 9c73b4834f4f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56272,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 42 names, Microsoft, language 0x409","md5":"337352e89c0a500c19e7c3a1cd83161c","sha1":"5987ba6a8b8c8cc7f755431eca614ea7f5de1b96","sha256":"7f5b8463e4c88e51ebc803105b9099def8163754f3a4453bb66f822878471499","sha512":"40d9cd93dffd18143dced57120735d2b31bb2added5cb801fdde509eb9f44db073aa69656befbb1eef6d957e3c4d77cb4c73e814ad72f64b46947c4a9e1d60ef","ssdeep":"768:PORWnLfP9U7ifzsufcbBUZPt7zrjrhPwUBUBv5pGUh08QtKFhj0akpAQ:POgzC7eQ+ckzHxw2MYq08QYrj0akpx","tlshash":"31436da6f721a30cd3676dbc985343b44b75be34be22475bd975273fee050a04c22a89","first_seen":"2023-11-01T17:45:54Z","last_seen":"2026-08-06T06:53:38.614541Z","times_seen":509,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_Bold-s.p.fbbe7604.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_Bold-s.p.fbbe7604.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"65560-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m8qqq7i%2B3n%2BTbxLTT%2BEW99v9qJ2GMB%2B77GSZ2eSLRwvnm0qwjThvYIwTe%2BblnPc%2BDjAneZLVqrgCpl80hc2ddPxeHNHmDWAlyP9PN7y%2FZasrz0I5uF3i6cw%3D\"}]}\r\ncf-ray: 9c73b4834f535ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":415072,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterBold4.000;git-a52131595;RSMS;Inter-BoldInter BoldVe","md5":"8f2869a84ad71f156a17bb66611ebe22","sha1":"0325b9b3992fa2fdc9c715730a33135696c68a39","sha256":"0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1","sha512":"3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834","ssdeep":"12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8","tlshash":"ff946a1bf701e70eca562c388af59bd033b9bc91791ee24b705a3a09dd971b40ad71e4","first_seen":"2024-07-29T21:54:31Z","last_seen":"2026-08-05T22:14:11.399518Z","times_seen":334,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/ad138cba44450f34.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/ad138cba44450f34.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"75e0-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JmtjPcMXsyPTzqIzQ80WrArsxPYlzucGFIQO68q4QbHBjwsSV0FPv9hHigrDrlkk%2BZeXEAX%2B6ufcixFERdVL8FHNew3MsZPD6WR2kJlicPJvxeIgtmAAp8M%3D\"}]}\r\ncf-ray: 9c73b4836f755ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30176,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (29819)","md5":"11ffb96341f3b620a5370514b73e3db9","sha1":"2451d15feffadad588466305f4a236f382f45e70","sha256":"a9efa5c83a5c5075fa40ef7ba4f7d964399f82426d6417889b7c84428f1b96ac","sha512":"8bdf52566b8af67e5482d9927f81970943cfe7386c5f27f4108d7d52c356bff8e9c971ce4dd132d8b5ec63c456b3465abf1bae4cb6a236f9a759ab39c94a734b","ssdeep":"384:wVm7PRyzVJe6cgrziQ+rI0TJOMLr1299HlDitlKQ96Wjzr:wVm7AxcgvSrTJhtcMLr","tlshash":"01d2b97071a096fc6ad344e6b43e400cb1386aa4c96d5561f3ba7cb8ca119c97e77f83","first_seen":"2026-01-31T21:08:57.360627Z","last_seen":"2026-02-19T17:02:28.728752Z","times_seen":71,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/eb768583117478cb.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/eb768583117478cb.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"1344-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nZCkVMQTyDSbQt2SlV6jij0Yvp2XeSbt5oBoyRAxXh5av0BL4dvWspreH9N1KsCQgzbBymFu54HTuv%2FYgLmVoQjqv3jAHvlZNggDff4N%2FWpkHg6FRrx72NE%3D\"}]}\r\ncf-ray: 9c73b483afa85ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4932,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4575)","md5":"cf2f085e4fbbf416372c204f062fda78","sha1":"e25ffad06ca3245489a474478f05d78d69203b5a","sha256":"95ac79e9e04a35bdc74d23248267dc235930c14e20b59c6536065072ce08696c","sha512":"1d6369070024d1452fbf563facc2e95332b477bb830bb3c1786e92137ce15d17dd0c81729eb5ea3eedb94d8195ad0de39f05b835b1a0f702f838f586a0dbddc5","ssdeep":"96:RgjKIjI4v5ksYquBKZ/L5QXqInDfwxbz4o:a+RRBs8Dfwxr","tlshash":"cea1ecb9031ca6ec7887446c23229423636fa1bf75de53b04d6fc9b458d74c8e7634aa","first_seen":"2026-01-31T21:08:57.370006Z","last_seen":"2026-02-19T17:02:28.648678Z","times_seen":71,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/699d240ba76ab6e7.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/699d240ba76ab6e7.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"9feb-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CtsDrSAfLPKH49k3Xv7TQnNJozd7SRM%2FXtad4OU%2Fe605xi5vA7ca0UkABbXevSVBhh8N85n1yUlXFPbMD1w9lZUpIFQR1UklEOegoLafZ64hguonP%2BabKfU%3D\"}]}\r\ncf-ray: 9c73b4836f795ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40939,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (40582)","md5":"fb3634cf9dbe461ce7b21964ef674642","sha1":"5be5159bc385567dce6e3ac8a821c4628079c72b","sha256":"4ef0b88dfe9e08a67e8361b199e7c5c0267fb4b0ec83ade00c6ca9d55f131d58","sha512":"a512adef8a10ff7d93d6fee4920da94225ddc9f03872b0b2d991ba8ed14cb6b136ebc6382dd9924f7a1c84f8b6a98ecba6dea9e484f774878da9fd576d27336d","ssdeep":"384:CeEJQfhNlOuEi1z9J9TvpiIuy7A7QKGwpRCSNBcAoU8bs541hAblbH36AxVeNyYi:CSN6y8QKGwamoUh541U9XarEqM3","tlshash":"8a03e9c5b320606243d651a384b50203f329a999540a455cbb7ceeffa97cec971f6f72","first_seen":"2026-01-11T01:55:53.435896Z","last_seen":"2026-02-19T17:02:28.60695Z","times_seen":73,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/0fb6e476b35fdb91.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/0fb6e476b35fdb91.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"194a-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r5tg42JDWYPOmCPh5gszxm42p%2FFiW3WGTllSvtRm5K65hqL5pJjbdY%2F2EMY3K9csXIAA1FYKe8dbRBAbd5LrQaFT5S0O3An8K%2FTMnLksDbIN4rgGVVd%2Bg7I%3D\"}]}\r\ncf-ray: 9c73b4839f9b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6474,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6117)","md5":"7554b29439c8f6c37345f5192cd3871c","sha1":"bad5b7974f486e1debe58b943058dcad206e9221","sha256":"ae0a6792e3ffba66ba1135d0bd193e8aab8347dc08da8bf813493dfd4c44b72a","sha512":"96c92e55b11be41234180b57ea457a71dabab8989577957af040ef79589916d3a7a7354f859b5aaf83fcb425ef10d040af7a581109b76fd0546ba1da7d54e6c7","ssdeep":"192:geZektmofqE26khTOJsn+aJ8c4Vpc/n1dWd:geZektmofhhkhTOJsn+s8c4Dcf1Ed","tlshash":"63d1e145e6581361b88802305667f01391ee367f30cf94a8875a86e4e7d699cee238ff","first_seen":"2026-01-31T21:08:57.315419Z","last_seen":"2026-02-19T17:02:28.614782Z","times_seen":94,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/favicon_2.ico","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:48.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /favicon_2.ico HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:48 GMT\r\ncontent-type: image/x-icon\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Wed, 08 Jan 2025 16:18:38 GMT\r\netag: W/\"423e-19446b5f730\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qCj%2F3VCm1aD7O9xEmOoAC3YUd5g1ycvKStimPgV08G62vaiIEGaPUIsrcxrH%2F9CiMiZvyLTiKTuz%2BSZqWk5ro90vY7YYJeq6xN5rnWc8cj5ZaGSd3QgL5W0%3D\"}]}\r\ncf-ray: 9c73b486b8745ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16958,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"862625c18a78d2a3bebb3990ed8423b9","sha1":"8aee24aec86045963d43ece03ea0c14bf84db605","sha256":"52d8c3814a66882aeb937eaf0bffd819d7eacd69c955f34627a2753a645f4d76","sha512":"0ed2e082fbe2427cd903021e90a59106984919b00075bc99e49ab738a87204277b5353c14299c920755365083b2ede65436c0382f84a5acaa59495c9f36f0373","ssdeep":"192:oTEdnrvnSuNIa6yxthZ5Howi4lpoIhaOSvE+11:oMn7v6afyEW","tlshash":"5872dfedb1c30f87cdb57af0e12686414b620c7007587422617fb2abe267596ba0f94f","first_seen":"2025-03-15T18:38:34.505366Z","last_seen":"2026-08-05T22:14:11.445881Z","times_seen":128,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-crown-of-fire.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-crown-of-fire.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40798\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:47 GMT\r\netag: W/\"9f5e-19baced3b38\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FcPY8slATCTVa5saYLH5KtmcZB0jLJgmyyIVqzn2bM5OqDYopx3s0hW4gpXAP1WOY3fs3OOwYLkCth3U0VncfHbRn0e06ySER%2Fwlr6oHfmDwxhDhskTk3pQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4980bed5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40798,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2d7a636be25df596d66a2bf69809bcf6","sha1":"62178363381012637bc6ed438062b6702faa39fe","sha256":"52bc588035fb3d6529a40c0d783b1b3e9a59456e19c02ce19224a03c759e537b","sha512":"30c587da4dd69aaff9cc4a0ccbc4705a91ac5c625aaaed2778544e3fb59b2a88fa3fc81b30a7f35bf12994a3a5376432d5dcf4fe4dd5022012b125982dd8f5bf","ssdeep":"768:NqAH3m8p8xkBQOIzqbI4B32kEVCDVWXKIUtRrPpIVj8he7J:Nq8m8pj12qsVOWXqRe+eV","tlshash":"4503f16d9c1091f8e4e8bbf28874f9e7cc7d9f50d2e81a15512a085fe26d0633aa5cd2","first_seen":"2026-01-31T21:14:50.662188Z","last_seen":"2026-02-13T20:55:00.811945Z","times_seen":35,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/account?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /account?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-815b456e962ce545-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 307 Temporary Redirect\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nlocation: /?action=register\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Ya%2FFzr5qDGr8JMjXd9%2F09l79ZKViE5KMsKYTVD%2BbyPaNArjXr53cBRCzWMYYiqjronmQbN%2F1yo2PqNTGy1QrN9G5hyXYArivZ5Rf%2FxDcLmYAruwTy%2FxnJM%3D\"}]}\r\ncf-ray: 9c73b499bc495ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2345,"size_decoded":0,"mime_type":"text/x-component","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T14:07:12.2636Z","times_seen":17762617,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/i/v0/e/?ip=0\u0026_=1769972572487\u0026ver=1.318.1\u0026compression=gzip-js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /ph/i/v0/e/?ip=0\u0026_=1769972572487\u0026ver=1.318.1\u0026compression=gzip-js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncontent-type: text/plain\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a45cd32471ce135a-0\r\nContent-Length: 1587\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9L%2FunW0RiiR%2F%2BxT7WE4JH3jPC1GCSCIHiyw2OuqrJyGrNJ4%2F0GAdJrUwF0hv0pi5%2F62lWMMvw99nvL9NBDvun%2FvkBP6k9zBarXLOk1Yx1TJUnYfode9ADZI%3D\"}]}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncache-control: no-cache\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\ncf-cache-status: DYNAMIC\r\norigin: https://postfinance-user-auth.com\r\npragma: no-cache\r\npriority: u=4,i=?0\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: empty\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a45cd32471ce135a-0\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.64.209.20\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\ncontent-encoding: br\r\nx-middleware-rewrite: https://eu.i.posthog.com/i/v0/e/?ip=0\u0026_=1769972572487\u0026ver=1.318.1\u0026compression=gzip-js\r\nvary: origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://postfinance-user-auth.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\ncf-ray: 9c73b4a22dc15ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-08-07T13:15:32.647925Z","times_seen":43661,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"postfinance-user-auth.com/api/socket.io/?EIO=4\u0026transport=websocket\u0026sid=F5kFgPvxx8BidtubAA3h","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/socket.io/?EIO=4\u0026transport=websocket\u0026sid=F5kFgPvxx8BidtubAA3h HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://postfinance-user-auth.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 7cQ3MT88yA48mQwuPnMv+w==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Sun, 01 Feb 2026 19:02:50 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: 2V4/a6X1GNoFWjnEcdZcCLzghYY=\r\nAccess-Control-Allow-Origin: https://postfinance-user-auth.com\r\nVary: Origin\r\nAccess-Control-Allow-Credentials: true\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=MtkLlRkS8jei%2Bs77HxIapQSHJ1Cd4ghWgIyVIZFhzVhfZLzTlMkXHOk7zYCBxyTZ03xB4hhX3X27VV8HIEGFIN4wUHOFMhXctdX77Qm8EI4wacG7rT8ywsf2Y1%2FNZ9YzGBinXchj0e%2FuWY32\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9c73b4919d9256a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=509\u0026min_rtt=473\u0026rtt_var=159\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3154\u0026recv_bytes=1672\u0026delivery_rate=7029126\u0026cwnd=252\u0026unsent_bytes=0\u0026cid=1823b585886a0c3f\u0026ts=175\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T14:07:12.2636Z","times_seen":17762617,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":0,"dns":25,"connect":25,"send":0,"wait":162,"receive":1,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/dead-clicks-autocapture.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /ph/static/dead-clicks-autocapture.js?v=1.318.1 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/javascript; charset=\"utf-8\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\ncache-control: public, max-age=14400\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\ncf-cache-status: HIT\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\nage: 0\r\npragma: no-cache\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: script\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 104.23.239.59\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VTJOg%2BWTN9JTyWoyHT1XmkJIY5CDSFYmAuEyUB%2FBZVa2hFQzwulCTtzizzGpPU1UQA4Co3zcJVQBfDMXgVnfYcoeBVASy%2F7Za1XxX6TIxBne70AZmjwR9J0%3D\"}]}\r\npriority: u=3,i=?0\r\nx-middleware-rewrite: https://eu-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.318.1\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding, Origin\r\nlast-modified: Sun, 01 Feb 2026 15:28:21 GMT\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncross-origin-opener-policy: same-origin\r\nx-envoy-upstream-service-time: 3\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\netag: \"697f7115-3303\"\r\ncf-ray: 9c73b4917a705ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":13059,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13006)","md5":"cc981e3687edce8a3d22380972ee45e3","sha1":"1955fa562b42c9f134b62e7ac0e9c11bbfa4da75","sha256":"a40d91c2014cca52defeb2481998498f02fc53526fd05302df0e0e490173814a","sha512":"2dc021b1b3ef375290f2d59d97ccc6bd6306aa4af2791c6cc29a129b50acc89a0566e5b27074037312082f55966c0bda2d77ab2ace32ad4a2154d08176e1c2c1","ssdeep":"384:sw+VM/tkSeCRi2WzHiAOjCQBgxjOJWgikn26FT:n+D9QeOMgM6FT","tlshash":"69420a88b7d0f3b12bd7145ac4bf1702f03525082556c824b159ecdab4adb1622bbe7f","first_seen":"2026-01-12T11:07:28.642714Z","last_seen":"2026-07-19T05:49:44.303002Z","times_seen":5178,"resource_available":true,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/static/surveys.js?v=1.318.1","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /ph/static/surveys.js?v=1.318.1 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/javascript; charset=\"utf-8\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\ncache-control: public, max-age=14400\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\ncf-cache-status: MISS\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\netag: \"697f7114-15b16\"\r\npragma: no-cache\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: script\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.70.240.13\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SOrxnsfEU5tNJUYuGbSjTOMmrOuWnUo%2FtXMavqEnaa5rKg0lVbDdIy1dgC2ZLnnsHSq4FQGG3VfQ2g%2B49i3oWxbrFwdWdcy1OnIm1hDpdni3Rk8fyvw2jbM%3D\"}]}\r\npriority: u=3,i=?0\r\nx-middleware-rewrite: https://eu-assets.i.posthog.com/static/surveys.js?v=1.318.1\r\naccess-control-allow-origin: *\r\nvary: Accept-Encoding, Origin\r\nlast-modified: Sun, 01 Feb 2026 15:28:20 GMT\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncross-origin-opener-policy: same-origin\r\nx-envoy-upstream-service-time: 2\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-ray: 9c73b4917a725ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":88854,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"eed1739be3b5f3cbcb8b4348da95df6c","sha1":"a6a9bb3c87a1d6a5e9a3c3fa4a504cdf5fb8c933","sha256":"aa71231d82c88044f916cb947cd23aae69f132701555cd8bce2b400c55ba388c","sha512":"cfbc612fe5f11aff4caa160599c8b2bf4291b118f8343596b0f447b2f5dc996d1cfd333d57e2893830174b1f6229dd49a8028dd13d3b31fe8648646e1eed875c","ssdeep":"1536:JXbkgL+74ocKIQvuE1p+5WeLIVZCnT9mYGfp/r4BL:1Ygq71zgZT9mYhL","tlshash":"b4934cd5b640f1ae41df81b4207e4842f33d2b1afa0d4958b157dc943de9848a39ffa6","first_seen":"2026-01-28T03:11:07.691683Z","last_seen":"2026-07-15T13:28:32.229743Z","times_seen":1187,"resource_available":true,"data":null}},"time_used":386,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Roboto_Medium-s.p.caaade52.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Roboto_Medium-s.p.caaade52.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"292c4-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qrqZVISRU%2FToCGAaCRpkPvuzofhxp3o9LZZnpY0N5SB51F09NimO3P1Z7B7v30h1U3aaLeaUvoQuZNRsMpisOnY9aIRq7RmYZCWCEjWIrkL58nubFmjncbc%3D\"}]}\r\ncf-ray: 9c73b4835f595ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":168644,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"GDEF\", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Med","md5":"68ea4734cf86bd544650aee05137d7bb","sha1":"3c6a09fcc6a454924c81af7dff94fc6d399ed79b","sha256":"9d0d55a303bfd13b79a87721f65185e93f235e2d77fe398b2dca67ac519915f5","sha512":"5d55a41b845f3a3ae9b08cee5258348dfd83dac5f0a0e48159cd85c141c614a02f8f474fa683d2bfbc451d49dd3b749820662d403b2e3fd3f16a242eaca64115","ssdeep":"3072:wqmtn5wkex8r6Qym7KCkygAKuXylCC9ptSUXl8j/6afWRCgqdhASD/80/:n25wklN7T3QtSUXz7XfST80/","tlshash":"73f3d701d241bf25cac6b6787c7c93be4cb5e41abc4aa52730d9ab3159c8805ec58bfd","first_seen":"2023-04-05T23:29:00Z","last_seen":"2026-08-07T09:07:57.024238Z","times_seen":2097,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/fcdabb53594fa7cf.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.643Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/fcdabb53594fa7cf.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"26d97-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lUunrWZibMRNAOCHiA%2BoHesH6%2BCA9JiSsdkIYCsSYE3gItMLqhup0Qtr4mvvqWHZXHdDR%2BNfeMCiCc06HIn0NR2bCjran2KOsnOg16NeUwPUAYPouvcjhuM%3D\"}]}\r\ncf-ray: 9c73b4836f715ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":159127,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (40218)","md5":"dc35eefdfb561070a6c3fd395b8b0e06","sha1":"0e99f80f3609455f7a1d0de1e932575bc2931551","sha256":"6df913cdbb4364f61f7eb112cf23d1b40438d47fe337266bbc9c0acefa387e26","sha512":"52c394db82cb28e8d4376c834989de504542e9d324d5df43688f5c03344a4388ec7328597a3396e7cdeeaf4e9384047a52d812771be24361972c3dac98d90cbf","ssdeep":"3072:3LSLiYawBqU4ebR8+K2k5tx9FpWgJlg4P:bSKU4ebR8p5txxdJlgW","tlshash":"18f33aaa33a725334be9829ea4b51200f3365658604e043cfb7c9dd7296888b71f7f75","first_seen":"2025-12-31T07:43:06.450662Z","last_seen":"2026-04-28T01:10:54.191549Z","times_seen":185,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/d9025b4f6a92ee7a.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/d9025b4f6a92ee7a.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"92e-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BGfj%2Fc29MuqBZj%2BAY7UYHXeqqqrnCD5l27imejI4ZFxcNW3rVP2Z%2FwoXrnkHHpkUWS7zqxxZKo1w5VzLVdm9%2BMu1WEpeCQfUzPniG6VpRv2EVwidLPIhHPk%3D\"}]}\r\ncf-ray: 9c73b48f3a1c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2350,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (1993)","md5":"a659a4b0e579811bc5023929ba4844ab","sha1":"d22f81bf0900edcbd60abf802263d8ec80c8f5ca","sha256":"912749bf60af5412f1089a97b3ab5bd639378d17917765c0b01537e8cc49a753","sha512":"4916005e5e2a0b57b360240aecdc5909c87c486e19a985f79ba95011c4cfb1bea15601a4944e22754114b24ba7cfbaec9867fdf3126f28dbf91aba0abdba790e","ssdeep":"","tlshash":"044154e1b671563b23b8059cf2359712b7a7883b810e05b0f15e882d19ec8d9929fb86","first_seen":"2025-11-23T22:59:50.452286Z","last_seen":"2026-05-03T15:31:16.590641Z","times_seen":189,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/bets/lastWinsNew?filter=highWins\u0026limit=10","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/bets/lastWinsNew?filter=highWins\u0026limit=10 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-80971aba56fe40ff-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dSwJm1N15V%2BdCwJapmrRuth0LPI%2FSYeLXhLGumz%2FFA%2BVJTAMAf29PU3x2RcQCu9jmr1gUgFyxdEYwYtR6qmSkwKtLKUWoVCH4WdtV%2F9I1YZ2mw4it1eLxT8%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"a07-ceSe5uvNUjscvw9KmmhuDGbi0KQ\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4987c085ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2567,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"091af06b323645e33af70c1c4f5ec818","sha1":"71e49ee6ebcd523b1cbf0f4a9a686e0c66e2d0a4","sha256":"8eb6f54e6213e2a53ab1ee0e3eb723afba785bd1742026ead5e79dc4d64dbeca","sha512":"af99928d1c1d24ae4f6ca408ce9b3380ab350ee831ef863d0971583fb99df497e9c722d07266e77f2851db9c029a6f45634fec22f65f587d9be9a6fe19fa24e9","ssdeep":"","tlshash":"7851003764fd1ca890091ec6a1c6392564dd211728c4ce508a9cdf3ea2f981ded066fb","first_seen":"2026-02-01T19:03:24.102409Z","last_seen":"2026-02-01T19:03:24.102409Z","times_seen":1,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/bets/lastWinsNew?filter=luckyWins\u0026limit=10","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/bets/lastWinsNew?filter=luckyWins\u0026limit=10 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b7ff0f5db07c1f03-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vx853r8S5trr69khOwtlG4bM%2BE3yON0%2BdAlyGAzLwI67iCb85Aiq6LEsnKTZq8W7sQfOt4%2B6avhh4Mbhi9EbHxZXUuX%2BQ6w9NUGZ5j%2BDSGKhGfNS5YjDjEg%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"5e8-cbJHBGaK3Pn7eKe8o3+BbfwSjII\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4987c095ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1512,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"96791ed36c1b65a7152f98cd625befc8","sha1":"71b24704668adcf9fb78a7bca37f816dfc128c82","sha256":"1db9f44adea4a7787ce0659ea22b027c1ef4082ed69b18f7d18548bb86124c7f","sha512":"a29091099c70ff05ced34d07eaeed594d9a9e9c873b87b4673cf3490d7c9126210a51ff159b64f2614c57d2a39b36adc145492801240133521cdce84b5b6ff10","ssdeep":"","tlshash":"9131d23e14b91ca4a0590a9671c27929b8ec741718c88d608a6ccf2d93f9d19e81b9f7","first_seen":"2026-02-01T19:03:24.104834Z","last_seen":"2026-02-01T19:03:24.104834Z","times_seen":1,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/be7248fa84c6d551.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/be7248fa84c6d551.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"9d3-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aKDI1VH6hVonwkqawJLUO%2FtsDOpWNeqkPThJM8a5ShcN1cs2ZwILkJCToSkt7jW5u1WAuFpZiGRSTTlTAu7eY%2BeY1SsVMZYlMkb9RMu8RBYZSwYYU1y7zvM%3D\"}]}\r\ncf-ray: 9c73b4835f705ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2515,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2158)","md5":"598a7c75a166616da34d0720a50b9cf3","sha1":"35eccbe396ae1d530fb0174811f94c4a35dd1c10","sha256":"99be381c3d3f98808a540d62ec9cb7fe1797ff9e3588e5078a26d52374152fa7","sha512":"5ee7366a017183c0a2049c1735a9135a139e62ed6411726d18b9edce9ce57e7d27bf5fe1b8ce6f915773d1d20e0c0a9cfa9ee383dda62d3a65043daafe744328","ssdeep":"","tlshash":"5651a5413444b164353629a8a0bf000e766e1b75834cbe3296fd74fd262189cdb676ef","first_seen":"2026-01-31T21:08:57.246674Z","last_seen":"2026-04-28T01:10:54.169753Z","times_seen":182,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/0645c0b51de69014.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/0645c0b51de69014.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"22b26-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2IWEpYdaNeDX9n4O3nQu5lH6npuYlw7hqMTJO0rZA0cd3cHr%2FafnA%2B9pXp3V9yE2KHMvGYFBhLsrRePpisYL0xrD2vQhcMRUz04BY6ieJZwocEDy3M2fxFU%3D\"}]}\r\ncf-ray: 9c73b4839fa05ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142118,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (47084)","md5":"9d45e69fbb44e738a07585f4a0e2cabe","sha1":"f8c9b2b7850b1007e4a64aefc1ea360954543a67","sha256":"0d3e866fc5f535bccc02dfbc1d9f5e717a06924bb1e2b7b7a97ea0b61c4a4006","sha512":"3c2a7ee5db4ae2941ec7ad4fff26f5672244af08fa839e54fd6efa302c1e5b43978de353aa5bcf3c96e9a0e8e5c8a2a693d962aa7f8cbc07b46435e5a2098986","ssdeep":"1536:6ofZm0sIEZ/gaCN2wIXdauLdKeyI+9DMvOEle10XsDJ+G6H4zJDVlDJKkTaVQcGC:QoN2wINauJXTT4z3KkLoN","tlshash":"1dd35be57140b5f85b6b42e1e47f8208b23d2978940e4468f3b92cfd22158dd71abfa7","first_seen":"2026-01-31T21:08:57.271535Z","last_seen":"2026-02-02T22:33:10.215161Z","times_seen":67,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-gates-of-olympus-super-scatter.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-gates-of-olympus-super-scatter.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40514\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:07 GMT\r\netag: W/\"9e42-19baced8958\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d8gBK0f%2Bn3cGmcfKeisSZsM%2F%2B1utB4%2FT0enzdUrIsKKLg1BozfxnNASpQ39fEEzyU4pxc8q4dwROVeZO6M0NXYRQSxzNmbhyzyGFPmbxOWV0Kyai2UxLngQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497dbe95ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40514,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0b43b5e579f3e550fc5e1b6e26b8a884","sha1":"c167689686d69594c9b8b12e5eafe1ffaa92b40d","sha256":"5dd7c5837e3465d2d80509ce95ef1e61cde7c771a575b2a2ed0c94049f36187e","sha512":"9d83f8acd0e03a5f3375447cae5f4aa37fb572719563c7c7d29961d0677ef0a9127d27cdfcca7708e7ffc2647524dbd28b95576c22190fba6f8d8fe2c9f417bb","ssdeep":"768:+NBZtqFwdY4mYjl/kwH52t7fkDiwsLKkJn3W/xLeiW95A6d2c:+NB369kl8wZ2t7fkGlJnQ1WH6c","tlshash":"4703f1ab4e5ac98dff526cba905b9f963f381d010425703bef593566db00495c213ee4","first_seen":"2026-01-31T21:14:50.701373Z","last_seen":"2026-02-13T20:55:00.810312Z","times_seen":35,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":116,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-sweet-bonanza-1000.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-sweet-bonanza-1000.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 27108\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:05 GMT\r\netag: W/\"69e4-19baced8188\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BWMdkUMxZIDRrbry8%2BOB2tGcOKuaWCifLarsVSGJmadGbzEK%2FzQmwRqQT8DToM1qfU60TxlDm4ECu3NYW5hP3AOmKUhN%2FMA4YYWNlK7TACKJWufbAVKJzY4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4980bee5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27108,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"365b5fb250b866d83580c3e6e68f7b1a","sha1":"d97f1593049b709297622346a2d88d1f0b5ab912","sha256":"a83d6af61d1352a4fbab1da1624afeb9a9d6e184775e3c30e9c3e63de2b2287f","sha512":"9b52f05fc3bbb1b8623d93714c359b42bdfc35e367b9322cb5070dbdcde7b970abf07d97481879c141c0940e894ec1a308051ae90b7514550d317600e9b890f2","ssdeep":"384:A+Imkb0cVr5dVs12T0V2N+SgMZ5NiAALbyQ+RjfxNQrUReRw1WssYL/qsaBs5j4i:2x3DTQ2NjxnHxNUkeREJsYL/qsap","tlshash":"30c2e08704e8176fe180f560a4157b796367c23c2ee1f56c44aa932b33694b50bca2fc","first_seen":"2026-01-31T21:14:50.684476Z","last_seen":"2026-02-13T20:55:00.830445Z","times_seen":36,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/reviews?_rsc=54n94","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /reviews?_rsc=54n94 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/reviews/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-83b903f19ce50c3d-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews?_rsc=54n94\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R2XbFdwdubmoUT3xDweiumlQOY%2Bcms%2FavFJ5DROgch2da%2BkXhN4KKTVS0m5xDXgmDShRHQ4Fqgieb143fGS1XgqRj0PB4fIB6jYBSgzLbI6MtnPFJZaOaJc%3D\"}]}\r\ncf-ray: 9c73b499bc4a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6620,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1621)","md5":"84f6dc95a2216560335e97ab815b5dd7","sha1":"f9ce48fe5b018c8d74d5d9b165d6a2ee9faeda51","sha256":"c7f86a5a60fe302ea25468e497c9fd6bc16c11bd246014c6eb51e31c2dd90ef8","sha512":"9e1f3c2fa5580e84e629460610971259366fddbdf62be14facb3244ee3b59c2c1bce8afd09337cdd93e4458a0df49116d6533213cbb8fb1c47c7c27ee1cca6c9","ssdeep":"192:BnkJZV9snkJZV9xnkJZV9TpEB+UeJ1EfSv3:yhCTpEb2","tlshash":"5bd1a5abd81efc581c36cd5c6c1f977796c9c93389344cace7adeda802190232b991e1","first_seen":"2026-01-31T21:08:57.310876Z","last_seen":"2026-02-01T19:38:23.504886Z","times_seen":33,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":113,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/bronze2.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/bronze2.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6166\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:16:49 GMT\r\netag: W/\"1816-1930f238f68\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PtOxx2R5SvByAkjQqYAF8N6cOsyF8DmGxs4RCj6S9tFsHLXoqYsT4cXD6ZSeLDoAPtC74hfq7SQciXYcRxHkagWuAsCSo%2B%2F1kEbkDI3NVzPcIv0AhMldirU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b4c725ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6166,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b0294eb179dee9507be7985f582da780","sha1":"4184da36f1fdc5d6fc8af440c3bd23f3641c0fb9","sha256":"ace7871d7d2f5adb69aea242ce7616bbc8e042327add531cd34be44041e2f21e","sha512":"369d903b083bb67b8ffac89bb6df8e5b451d6545df956d0fa631c8e4547bca0a6b0f1e21e1ce4f1f68cc3f31da064a869014cfcf37cac8708444bc367d056c0d","ssdeep":"192:2CsTxSBvEmFoRPHyzb04BFHbbPOM1FIqhELq:wTxSBvIVe4SF3WoFlELq","tlshash":"0dd18e72a6f7457c516b05494a14b8e1a92abc26ad91c60f067680f6a2d00f289fdcf1","first_seen":"2026-01-11T02:03:05.487189Z","last_seen":"2026-02-19T17:02:28.727051Z","times_seen":35,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-sweet-kingdom.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-sweet-kingdom.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 36004\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:50 GMT\r\netag: W/\"8ca4-19baced46f0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EhdVa6DgafZZMbJJbCoRNWWnw9n6e2bdk5rFC2fhutFUP%2By5DsYXISTIvPT%2FiAJvOFWfoo7jQR7kDTqSgizSf9LY8y4j2bsutDqxpYaozCrx39QV1CVK0jk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b4c735ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36004,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"903d3129e25dc3a84865b522a747217d","sha1":"0abe16e917367b3ac658ba7322de4a80a53f0bae","sha256":"02e5b83dfc63cb16a98ad4a0d051aab85a5ef73814b35ecd3388934d1d3b117b","sha512":"e47b9eb636228e266257a8e8e3b7dfce62a8092d936c2fbc226ba42e11bb44a752478508535780a0c949d008f98a01c9e55d9ff636999474f11e9eccbd5c4594","ssdeep":"768:b2x9+GXNHLoUDLlbwcvZ+EewqyyaBj3icdu/7lvIo+de/kIfGFM4MM2Xlpu3chfq:Cj+ANHLxNTZ+XoicduTlKkkIfGO4MM+c","tlshash":"35f2f2229d1c37b8d85b0d2c4ad521c9573792367f492a7413d37ac8a4fe062a73bc6e","first_seen":"2026-02-01T19:03:24.112047Z","last_seen":"2026-02-01T19:03:24.112047Z","times_seen":1,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/gold3.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.438Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/gold3.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6180\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:25 GMT\r\netag: W/\"1824-1930f241c08\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p6ZxkATjje9yCnuXWcoqq%2FAJtVV%2BompRK0%2FKFucBOivMACKBNl8Ni%2BVa8%2BcbtgX%2FSJPjMnwxpPS7xFVyC4LuTRFz10Cp0rfO09DjgppEktk7EzhDpiv7p5Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c7a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6180,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1b3b6925c68588a11877b4994c793345","sha1":"360d0a1cfe4930a8160ce69d30441a37bf0d56a8","sha256":"9359737daba5e683c10d20dbd81bb7b441ae5af9c138f085aec6da5539be9788","sha512":"751d244e5eccd6c6805f9b268fe435bf81381335371c92ee68e25d6ddedd0293c33a6b09589cc849d291cb5922ae2cbd3ce58cf15a137624faf9a93c23f3518f","ssdeep":"192:sCDeuxFQkAd+vAGo+KXl4R//v2NiqIvhrBR:sc5eC2xKRoIvhf","tlshash":"9fd19ef9a15ed1f5b6abf40e8438517b6f8fe8fc56516c0c49180364f24e275b444837","first_seen":"2026-01-11T01:55:53.553476Z","last_seen":"2026-02-19T17:02:28.870783Z","times_seen":41,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/eff55acea53ec0ed.css","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/eff55acea53ec0ed.css HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B7yqhl3vWJzkfg7oSLZ77K7hu41mUZqj2EBEXNOKocO%2FsAe8UVLWLesG7vrNqM94Odacs12VhKYSk5f7er1Az4Oxvn5ciz1bpHTeMezWaZRh%2BH%2FY9ZWjRoE%3D\"}]}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-encoding: br\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"53-19c15989c68\"\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4835f5c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"765bf9d3ef8ff10be0cad5b6d4e3daaa","sha1":"aa1b4bc7fcf48c46eae19700dd7509519aa0ba85","sha256":"f403a5500f2dcd2ecf20ed8f0d77487d89495c3d3789182da4975fe7db6e6559","sha512":"8da6091440e8422a6931d64239ad83324f260ae3fceb164b1f20954db67764ad5425cc19d1ec48870932e42f9e70c21349f9ea3179ae77bf8d8c1ac547289915","ssdeep":"","tlshash":"cea012804541f754e5d148f3d0ce2110888c4718019485e421541de0980742c1372f4c","first_seen":"2025-12-31T07:43:06.46324Z","last_seen":"2026-04-17T17:22:40.725573Z","times_seen":109,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/2c69dda28e67e57e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/2c69dda28e67e57e.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"90b-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fwuuCMUQrNF4CCMwieJGw2wYH86%2BU20aR1NIz2Jq4Igzf4ehL2T2U8SyVOXYPoEdclwG3tKh1st1zSHvvMHViqBPCKtjPV%2FxioBAGbWwvQ8kNvx65VE6mjc%3D\"}]}\r\ncf-ray: 9c73b4838f905ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2315,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (1958)","md5":"33dc57bb9392fef432b1f5274e953108","sha1":"b98c3c6d5e93c3b768580b4dd7850384eaf61955","sha256":"6cfd34df21a22ff32f90c60f4b88b98523ade92b6a03432c4ba62b9b72701b97","sha512":"7020a27704c45175411e81c0bbb8b9c4d0dac262bf3cc8d29bde16361cc08e093d0ce2d6c4af51646777129a64c45a3618382b54e5bb80ae306cb53d1a92d945","ssdeep":"","tlshash":"b441a7d9a3507ab41cc82bf086730012618631bb72cb54b4c33989e0b6978d8e7e789b","first_seen":"2026-01-11T01:55:53.495242Z","last_seen":"2026-02-19T17:02:28.678451Z","times_seen":73,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9eb0ef8f216649a5-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LpAzIpTlGK1V5R2skHk1tRFU655Vj%2B6d8f%2FbqUsOxOHlUh7c1cBMWQcol0vlhyL1V%2Bq3ofKau33i9rBXIiv1noa0OKGNGPtG%2Fq2C9IkM%2FB5nqDJTx7%2BBeTg%3D\"}]}\r\ncf-ray: 9c73b4951b385ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/inout-chicken-road-two.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/inout-chicken-road-two.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 21086\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 18:08:21 GMT\r\netag: W/\"525e-19b7abf1208\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DCp03CcDAIDF8JU5XRkmpjKf9Tbn5ET3IdrmtGXDTTs5%2B4piec7ciScfOI9FHM0w6Egisp13LslawNOgd6uwud9G55BWSBhyLJWsayi9KjTcLCBYhW9rBvo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497dbe65ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21086,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x533, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5c51819308d47956aae4f440b78a3738","sha1":"dfcf53c70c19bc4b092101b2747347e03914810c","sha256":"d24c9029163fcdab092d967bf9ca0e92c0765f65751d17857c65c66384d575f9","sha512":"8b5eddfbac12e44eed0c84d72bdb1236f8b012f2e8cef45e59c6c64fe63e0f165f60f774b1f7bfa532ad9c68edcd0a9b358bad2ff02ccd014c1db2a9e8e422ac","ssdeep":"384:ovnk0XgBvzmDivCF0nWW3N5p9nuW9JsnvagAHUeVbCKwnO4KtkP2N0D:oc0XgBvq0nWKYKGnvQt9C4te2N+","tlshash":"c892e144f1c681192f7622dcbb9edb86d5c085922048496ebb7e1943c7b2ed583a478d","first_seen":"2026-01-31T21:08:57.30618Z","last_seen":"2026-02-19T17:02:28.739386Z","times_seen":71,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":119,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-jokers-jewels-wild.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-jokers-jewels-wild.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 34862\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:52 GMT\r\netag: W/\"882e-19baced4ec0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yvnortQlig8PJ5qRfg2yGXEABjm10BP7klsLAhI%2FkNt%2FrW23q71ygbXU0Dn06xO8uiWoGtLPfGjyB7ALqphdjOI6lwUlpPfjFSx2CgIiK%2BkPniXsejWz9Uw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4997c345ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34862,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"83ad3ceaa392939aaf9765f169159f71","sha1":"db0f48050ea1bdcba037f51d1c409778769056f2","sha256":"08fa1d817b759803c16ea88c856cbb7297cc81ed220a2e98de837b91f168d7ea","sha512":"ba6296f462978c2efbb4635243840d621370fd76aeaa738c3f5d856ab611d5745ac15f577d119694497c267deea07ed3515e6f65d3f899d2876f200db2235085","ssdeep":"768:Lr5u9WA0reJGvolOT6Z/faaSTBBwrtcbl5o5PcnAaChZ/rXCWNyZj/lF51qQ:H5u9WOJblOeZ/RGPwrtcbl+WnRaZ/zj0","tlshash":"76f2f10177161ce8f85f205a2ba9e6b4eaec127853da86e2c591537f405bc374e6fc0a","first_seen":"2026-01-31T21:14:50.702431Z","last_seen":"2026-02-13T20:55:00.748069Z","times_seen":35,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-shining-hot-100.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-shining-hot-100.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 34292\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:00 GMT\r\netag: W/\"85f4-19baced6e00\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ff0zMJC7hTLnUjCGoTK0M%2B3SO58MsywDDUSkV4lQ%2FKic1QSZ0lK1J2N1TnDw4UYliwk%2FOTstjqvKbTjjpZmotS9NwvVAAf1qu4vARMTv3pQ%2Bd%2F7CIkWDhNI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c405ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34292,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d24d18816edc6afd94ab4bd412e481a0","sha1":"8c9cac1969ca7d0c0cfb619cfc7154632eccf75d","sha256":"ad82d16e04457cf9961b5d58e6a714a468c6c5621747bf5f91f44960976eaa64","sha512":"346a5dc477a6c28876b8e0ae496e960be42f9d3c1a12fe59c2d6f3441a980716f44b8b4ab03e45d27c37496dd9b6c982ebcd808818dbdc7d0b27adef578f7b01","ssdeep":"768:TcsntuNsHMk4Pjw9uCMc9m7oUARe3KURqY:bntUsy0zMc9m+RIZL","tlshash":"82f2e0246a26d894c24b3ff80cfdd9a5c7673fd2bd84625bbe1c45652bc232a8d8914c","first_seen":"2026-01-31T21:14:50.694993Z","last_seen":"2026-02-13T20:55:00.835585Z","times_seen":35,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/944ac4923c54ffbd.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/944ac4923c54ffbd.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"1121-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ACfOkgXM14KfXMLlP3ohbhgNoG8mxuMEOzH8SVO7eXQeuXbSFg01QGB%2BWONJCtG%2FyKiPELbeFXnp8E4TiVVWINIeERYKDvtiO%2F66%2F1tAjzaDmWYp763kRFI%3D\"}]}\r\ncf-ray: 9c73b4a08d715ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4385,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4028)","md5":"e0a3c6529b52f3ca76fac8b4824ee9af","sha1":"38b98c5b73f6c046e438618cb9085e16dfa344cb","sha256":"28f068c9ca2b7701f59bf1e653a54c3000dc2191a0800c26c1693ef283148541","sha512":"bd0a312fe3106a32e07f3c53a52c6ec5f4d434a2b485995731710da7d9c69c8f1aae5536cdb8469914ff8f2228875d802ab55d30af07eb0183e371249fa8b94a","ssdeep":"96:ESEwSEWAR3IWcvh4KyqcnnToxHYypVENVIctVwdj6BKGyFpEKo:H1KW/nExH/pVsIctC6A9sd","tlshash":"ac915494a990efdcb45e01a8a03dc00db16d6e6dce1eca39f1ac34b129550d53b6b7c6","first_seen":"2026-01-11T01:55:53.465489Z","last_seen":"2026-02-19T17:02:28.643228Z","times_seen":73,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/vip?_rsc=y2r7a","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /vip?_rsc=y2r7a HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/vip/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-861bccbc05aa3134-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip?_rsc=y2r7a\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ITsTE7Jcia2Jn10NEaKTYZGo85b40mhJa2vcT4Bk6%2FAxO3gfwmdV5P3ns%2Fv1Bgz0sYmx8KrTC7X2BR2pcRcSEHxksa0ObxigQpttotPSKO4cTVanPi4q%2BTc%3D\"}]}\r\ncf-ray: 9c73b4a0dd825ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18211,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (6085)","md5":"023b5e9538acfd1509f598184fb27e7c","sha1":"2fb6d6e6db1579f7c86fe1a577856a02c954bd07","sha256":"d15e88c0e2161ed730dbefe4be81894d51e4e0837ef8cc9e88caf5767a28fa02","sha512":"1379e279c71866db25c4968ab52a1bedf714a1cf2042630a3b1cc8a9d8e728f4835a8f2fc0a8e77bb53ffd2202af7ee187dc1e34eb20864977f544aab5831f52","ssdeep":"192:dlnkJZV9vnkJZV9pnkJZV9FnkJZV9rKnkJZV9pnkJZV9+nkJZV99rEBdFnpYj6uX:s8KW/Kn9rEf2wKVCIJZ3gppKPd","tlshash":"99820b5bc81aec640d76cd8c3c5f97b796c5c8338c354dacea6edc9c02594275baa2e0","first_seen":"2026-01-31T21:17:17.959937Z","last_seen":"2026-02-01T19:03:24.122579Z","times_seen":2,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":92,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/array/phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN/config.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /ph/array/phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN/config.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 484\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\ncache-control: max-age=14400\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%7D\r\ndnt: 1\r\ncf-cache-status: EXPIRED\r\npragma: no-cache\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: script\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 162.158.95.200\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b7SGUbd5MPrmju7XX1r5SoZYYxpTTdipd3np4lai08s07TviI0JG1H9%2FkSUj6Tr9Dm1TPzZUjUimp34y569nMBada4l6VSC766JbA36R3JjnzF5dJ6czMk4%3D\"}]}\r\npriority: u=3,i=?0\r\nx-middleware-rewrite: https://eu.i.posthog.com/array/phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN/config.js\r\nvary: Origin, Referer, Accept-Encoding\r\nallow: GET, HEAD, OPTIONS\r\nx-frame-options: SAMEORIGIN\r\nreporting-endpoints: posthog=\"https://us.i.posthog.com/report/?token=sTMFPsFhdP1Ssg\u0026sample_rate=0.1\u0026v=2\"\r\ncontent-security-policy-report-only: default-src 'self'; style-src 'self' 'unsafe-inline' https://*.posthog.com https://fonts.googleapis.com; script-src 'self' 'nonce-6sih4YrCsLlHRY48QtiB9I' https://*.posthog.com https://*.i.posthog.com; font-src 'self' https://*.posthog.com https://app-static.eu.posthog.com https://app-static-prod.posthog.com https://d1sdjtjk6xzm7.cloudfront.net https://fonts.gstatic.com https://cdn.jsdelivr.net https://assets.faircado.com https://use.typekit.net; worker-src 'self'; child-src 'none'; object-src 'none'; media-src https://res.cloudinary.com; img-src 'self' data: https://*.posthog.com https://posthog.com https://www.gravatar.com https://res.cloudinary.com https://platform.slack-edge.com https://raw.githubusercontent.com; frame-ancestors https://posthog.com https://preview.posthog.com https://vercel.com; connect-src 'self' https://status.posthog.com https://*.posthog.com  https://raw.githubusercontent.com https://api.github.com; frame-src https:; manifest-src 'self'; base-uri 'self'; report-uri https://us.i.posthog.com/report/?token=sTMFPsFhdP1Ssg\u0026sample_rate=0.1\u0026v=2; report-to posthog\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-encoding: gzip\r\nx-envoy-upstream-service-time: 7\r\naccept-ranges: bytes\r\nlast-modified: Sun, 01 Feb 2026 19:02:49 GMT\r\ncf-ray: 9c73b48f5a275ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":860,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (661)","md5":"18c8e920a48d5bb95921e6187c07df2a","sha1":"fb3dd7bab6f2653b6f4a734c0624ef46ca779d78","sha256":"20333bfd82aee4085ca68fc8768b0b251267ca5b5c93d3fd464c690eeef54b0d","sha512":"0a10abcba25f402288531176bc4ca609daf16ad26b3d678b1de79e37dc449b3a647d29b4efc90e63d2153d273fc1d0cebeae2adc797fdd432ca5751f96cf9601","ssdeep":"","tlshash":"1d11ab1cf9a004ba00e6715c5fdbe1836fbb858792444c2cf5c40550f70ea2b9543fc0","first_seen":"2026-01-31T21:08:57.376306Z","last_seen":"2026-02-02T22:33:10.199626Z","times_seen":67,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/logo_blue.svg","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/logo_blue.svg HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 23 Sep 2025 19:28:51 GMT\r\netag: W/\"556-199780cd538\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oi2P5zTKdoCQu4G4Ia79Qvvz%2BzcgQK%2Fi9qRYzYJiY4Y0rOHHvHoDHA17BrTDcRNsydcTiAL9GNsi3g290vDrioCHPoLp3z3mkbDSQI5Ku%2Br08oNAl%2FmdMbo%3D\"}]}\r\ncf-ray: 9c73b4912a5f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1366,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"eb70d90349998f9fa492bc2a907fe894","sha1":"54823ba083d0332c2ac42162d1a4c6f47478050e","sha256":"00f69279206e53c192bdc9472d434b948a56123c7e5c2fce096432e54bd87f77","sha512":"c4c0009e1577c177a428fed81430f234d6f65c83f2b56934bfb8b6a1169f6488b06ff24e8a144e15fd427366ec65dee3694acc028ed433460ff5a6545ae24c68","ssdeep":"","tlshash":"1f210fb8b099d936d234d36cfb98d42591a082d7c4c58069b0c9fb2f98698c35f1e3f4","first_seen":"2025-06-29T20:05:39.730735Z","last_seen":"2026-02-19T17:02:28.733605Z","times_seen":79,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/home/promo2.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/home/promo2.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7574\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 21:01:33 GMT\r\netag: W/\"1d96-19b7b5da3c8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HDjLr6txGiaeLWmJMaRVFSgh9PDzkyCdszIvHL9mzDJOZ7Jp7uEDfEocE2x4mIKdF7QHRfH6nbnyMuNkVTrbmYqnxDX1%2Fk0WOXM%2BMZHFtdig5BQUx7AeqXk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4996c305ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7574,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b3539038ae01db5382d54a6c94823d21","sha1":"a9932b694e2b9a4111043fb5c72af4da83d71ac4","sha256":"db04cc3d02cdf2846d24379ba9dff05f55bd367222be7ba31e5708adf7eb8141","sha512":"189bda25bf1a096b42a402efc0cfa2d6d53caa3ee850fa2d9ac939bad17e2cd9cb1e9039011a5e66081fa5ce1c9e82318c2e22eebdac349e8c629fa3461678f7","ssdeep":"96:88NtxuyL0zqjkZRMK+UmtCPbSMRPHM0EWuQbaCvwZkLHFAP8jLeG5J3wLHH0:PN8ujSRQUASVCWuMvwCTFosZgo","tlshash":"f5f1c0720a6d0a7f7a0b4df142c9fe92d107788527a99d451d479fd081e55de07e042b","first_seen":"2026-01-11T01:55:53.552654Z","last_seen":"2026-02-19T17:02:28.854451Z","times_seen":73,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-dream-car-suv.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-dream-car-suv.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32702\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:59 GMT\r\netag: W/\"7fbe-19baced6a18\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QRagcrxFFIyeWqOZA4Hn8kdeWuN2pWt7ABjl%2FpYKavbuK5HNurAJzNdX0zvnfQ3uPgCqPOlGClePo64s0XeCY2xk9CxegnXc9mxkXeYDJ7c6Ks92HkWciqY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c7b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32702,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a9c7ce146ff8b30ee6b898672a051ead","sha1":"74a8e35c65188399d37a97440aa87794257e8ef1","sha256":"12cc928f4afb4602c9662be7ec061ebbb2fad73f5cfaf137c17364482acdefbc","sha512":"b78098d5a5b9781cb2dcf3c6b813ff881daf9bce9d6efb4ac1092cebbf974cf1fa5217dbdf2abf9afc04ea17128f970715d8688391b28335f8ce6c33b6972dd8","ssdeep":"768:IJV9NjkvJ0GNjJEejfMFryo9HyGf/cIazQYU31VzAm27YuanJX+X:WLNjWJ0GNjBYnMIyQ5697unJX+X","tlshash":"75e2f15602ae6d84ed99a84e85c36ef804dc1716f4866a33f037d0e4ff463206f65a90","first_seen":"2026-02-01T14:19:43.880884Z","last_seen":"2026-02-01T19:03:24.128345Z","times_seen":3,"resource_available":false,"data":null}},"time_used":507,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":501,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/group/slots?_rsc=jeq1h","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /group/slots?_rsc=jeq1h HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/group/$d$group\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9682eabff6f5cc6c-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots?_rsc=jeq1h\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5L1gmUjoxlTforLaO6rwC359j%2FtXQw8WL9YBRXVoctAftQpxl8uvqaqCz0cz2kp1868DxiBzQcoWDNPNTT4CFSnOld2manK2DACZHmG8KJZRUHo1Kth2aYE%3D\"}]}\r\ncf-ray: 9c73b4a1fdb65ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":90,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/e3d00364d13321ed.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/e3d00364d13321ed.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"4753-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cQ7mxZOuYI5aigEyVBYLSCdFKIGbcHxXp%2BjDynz9eD0zJCk7ePkfqvDTZo2H%2BV3WCNVFzyCGFAXrBgszJblRMGM3K52MgTUc5YBoNIi8Lb%2BobyurhZH90M4%3D\"}]}\r\ncf-ray: 9c73b4836f765ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18259,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (9993)","md5":"2486934aebd0b00e55e68b6dfbe9d0fe","sha1":"848dbefe394be98e044928f1374fb59929c92f93","sha256":"11380db3ba8aec5597b4cde9773951510aa89424968a8c7435db112f37901b0d","sha512":"807a83e35db9c4bc646787d3a154bf2e80e386daafb9fd97ea6059fbde48bbc924847a8108bf120b524c4edccc89acd8e5139ae522a1a2655a29dc720a4df54c","ssdeep":"192:uF1HgFrAHRNiN/Rv3cGggerToWWeoedmPWo21UCS+94eNSIOEPZJJb1I+7mTH47C:YHgcRNiN/ojfoWpHmt21u+9vdmTHS5W","tlshash":"1382b6ea7282f0b197bb10a2c07f400bf2793565245d4054e7a6c8ef74f056e86a7f7a","first_seen":"2026-01-11T01:55:53.455045Z","last_seen":"2026-02-19T17:02:28.7957Z","times_seen":73,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/ce91559d705a6f80.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/ce91559d705a6f80.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"c28-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YVuPIYs2w%2Fw8fQSpIi4RWbmZII9%2BazQID3HZkYwZNxRYgJnOofuP53SmEpjZN9pbCfjk6yC4vNAV3URSteTMMuzBxGG27BTORKO4SSihmVh4v7kDu5Mp3z0%3D\"}]}\r\ncf-ray: 9c73b4838f915ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3112,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2755)","md5":"ffca57ca28216716952658164becacfb","sha1":"558ae2e920765a2076592b4b168b3d4ddf339d5a","sha256":"bb1d593df6a0ee012c5e177fbff4f96e75910044292eb6e9d451a35eb38c2c2e","sha512":"c7bfd7c23d31e691b37e6158532f112b8c8a7cd587476f7330b4d41c6aa9e8113d2cfc819c8a4fe883caff42d186b029ed92e0f03ab20c04ca3024852228bc1b","ssdeep":"","tlshash":"2051acc21a4803bda9c691747215751393ae21bf75dfb4e4cb2d14b8c293888eb734db","first_seen":"2026-01-11T01:55:53.524258Z","last_seen":"2026-02-19T17:02:28.647973Z","times_seen":73,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=an5yy","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=an5yy HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-bb3398f0538cdc95-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=an5yy\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hf4juQckGW4AI0eZhVJtLaOaoAwMdu%2BKAQgzzpSWU0s7UfHTn4apHdR0SUgh0aQJv3K2WvdSNBSCcdHG4g9TPmUGkKJb5N%2FayERETMr2jNWTz0Q%2FBIkcGbs%3D\"}]}\r\ncf-ray: 9c73b4969b8e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79193,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (30881)","md5":"a69fe82397a4ea26eddd47619ca481db","sha1":"4e740329d7c90184027cf959619f83f966315617","sha256":"ddf4f760ef6fac08ca36400803187587048d9dcd70219a9b363a05fdf985809f","sha512":"8d8a3a7f6112bfccba1b656c4e4c51c49d8630f6c30e08a721dbbb48d33df1aeaaefe389f703c627c564fe7a637a5518bae83efdd37175430c3dbbe0923e1863","ssdeep":"1536:qIbaSjKQqlrFsQatbmhAzKGlFROu5TXaV80my6:15qlrFsHbmKKGlFRj57aV80mX","tlshash":"0b732c1bc80efc680d66de9c3c5f1b7796d9c87399304c9cea9eccac01595279baa1d0","first_seen":"2026-01-31T21:17:17.880154Z","last_seen":"2026-02-01T19:03:24.133407Z","times_seen":2,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":87,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-hot-to-burn-multiplier.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-hot-to-burn-multiplier.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 42614\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:01 GMT\r\netag: W/\"a676-19baced71e8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IFbxmRpvDtzmumlBNphg8gViE%2FmQ9duLX2Mji38SdY8Bx06jQb%2BwLxuO9hs%2Bem3XOBx3ti%2BIlEslr1r5U1n%2Fc%2BHE1%2B4%2BUbz6JfyhGWcseOAiuhTzCgpH8eA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4997c335ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42614,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"17c7a49ccfb628eabb4d15b972171fb9","sha1":"12ee12723eb1150a75eaa874be22b571bf0d4138","sha256":"4a623c7a5c89e06e61558687e12e0b61cb1f2b1570689dab4d5d5cf6ff787a16","sha512":"574918f94e0de11c53440eb97785cf20723544783c558fbdf778f99cbafca83ba92731fd8d2ee42b0bdd386ac0cced5ae18a939be6d27e0f328d4869a13a9161","ssdeep":"768:3gC6w83aLKTb9pyrLNPwLeW/01zCvkf0c/uj7R/2lu3qSvoqBtKIwH+d:3Bk3aLKTb9pyVPWBEzCvkf0cGReAaSvp","tlshash":"d913022376130e57e438869f25269d029080664e7e16c8b977cf5f2474ba8e7c51b8ea","first_seen":"2026-01-31T21:14:50.717363Z","last_seen":"2026-02-13T20:55:00.779536Z","times_seen":35,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/iron2.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/iron2.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6118\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:06 GMT\r\netag: W/\"17e6-1930f23d1d0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GQsQc0Q%2FsW96m8EDrsC41MOXqdu1oDtAtJs%2BaNxvK7Ob5koSg15v%2BaT0FCf9fzvuE%2FuwPyQBgkq4amYrY7%2BDqpLa%2BiI2Lv6SkkkJYyfw%2FagHreVD%2BbbT2zM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b8c8e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6118,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d28114b48ac18944215523860da3a5c7","sha1":"28362795f12361cc91e2f6e07105b8c9fc3edf09","sha256":"5dc83996a07a764a4857682d8787b8227d5459b226769596d67a29c678d16c99","sha512":"d66a50afbbab7f802d7ee838a865d1dc0e8499b3ea3c83f164677f43fb503d35c85dde4c8b254aad28b85c52bcab62624bc608f31e9d9e4c7d2b0bd89687432e","ssdeep":"96:WyAJFk2Vi06XAhJK5gi6XehC021eJoeDO5uCuKSBtQKdy6J3Dw/+Athr2GWho:YJBVsyRXcC02IdQuU6Ji+mrmo","tlshash":"9fc18ec362fcd24eee805cabfc32418ddc14ddd24e602bba5d8d9d006525e2e3a1984e","first_seen":"2026-01-11T01:55:53.50367Z","last_seen":"2026-02-13T04:13:07.677692Z","times_seen":46,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":551,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/3d29fa3d9e6cec4e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.643Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/3d29fa3d9e6cec4e.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"18e2-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jy7AP5uINTqjdEC%2BIj%2BWUO3%2FExVo%2Bgdu43VKwP262P1uFYOKZ6wG40%2BxZTdZm0Z6BPGnu4aU0h0F%2FD1NpihOecs%2FgfZtJus0JYCvWLohdhfjKwsKK2tZB8g%3D\"}]}\r\ncf-ray: 9c73b4a30de35ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6370,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6013)","md5":"103bce398bf72f998ccceacc2ffe6e80","sha1":"db2b28d3061395776a370a3539b6ae3bf15d9dce","sha256":"29b058437c3f7686ecf84d33045a537cd24e4f01807e2af5cec8649b51b1dc18","sha512":"10f6ace8ef1373d40e4d4376c214dfaa5e4a45a1dd6a6a0106a59756da63c78791241555c08f24471707cff6fe63ed751d2acc6a6dd00b6ca7538073507e54f1","ssdeep":"96:v0dZm2etxGIWIA1srSVMS7frIDtjyMB0whWDxcxv:R2efGII6sr8j7focv","tlshash":"97d1734891969bdcf5b704a8e92e816cb06d5fa5cb5d0978f9bd38351e000d07e69bcc","first_seen":"2026-01-31T21:08:57.217994Z","last_seen":"2026-02-19T17:02:28.862354Z","times_seen":71,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-lucky-shot.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:59.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-lucky-shot.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32118\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:06 GMT\r\netag: W/\"7d76-19baced8570\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DboxgPh%2BEIpsvAZeH22bpAAuAeIg6AfSWe9azKeBPmpB0IB4DSAdn8V94pUk0ZAyezNyC%2BwAAknOIzDmcW9kM6ZEQB67SqkYkpmGx3z1Wx0AeLd6vqdPknQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4cced5a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32118,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"89f788ca46db8cb83186429bad9b956e","sha1":"d5e7c1001f2d583a3373bca6b5729d13fd57a10e","sha256":"aea753ad41750c50b9a0c0b16b888e693ab70b5e4942b1cd0f53d643b44d8b52","sha512":"328bd3a1acb59ba8b88cfb1a059ed217c00791a3abac4b2fca0b1d0ef60a0480713518db4a6e53d7fe4ba1f0095cc4acd8044aafa06b44ce5884af5f99dd870d","ssdeep":"768:s8gmuZQiIzdYsmnnbxjTbPPiCzi4YJSeEttJQMCqFU082Ksq:MBIzKrnn9rPKUHOEnXPq","tlshash":"c0e2e181ab0af1ccd66d557eedcae02c9168b370c9fc34515a420c194db3bf2e12d947","first_seen":"2026-02-01T19:03:24.138575Z","last_seen":"2026-02-01T19:32:48.137586Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-big-bass-bonanza-keeping-it-reel.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:03:04.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-big-bass-bonanza-keeping-it-reel.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:03:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33500\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:58 GMT\r\netag: W/\"82dc-19baced6630\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iVTWpqs1NkSelgBTiTpqY7vcIasyrqFoti7lgmyQkvDvWoTNkqmjKpY%2FUszCyoPv31mJhjTGE9QmdT4EBKNqBIXJugbmYHoda%2BDKHuqATSJrdVRnht%2F6Mpk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4edfc4b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33500,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2739bcca97e791e25b6daf425a578e3f","sha1":"bd3efc508de179322396854b88d2556dbbb74bbd","sha256":"7478e816bc3cd142462ecd3ea3ce313822c55af4f10c092e3fec754eef1bcffc","sha512":"0cbaab4ba452c97208b610fa1d3ffb8770dc8b9c8d8cd23ea5e986b4b5ee2729358375ec4fbad9792351c017b01cd1596d9ab017e229093e2b25ddb3ffb6e16a","ssdeep":"768:PRLPRzQdIjOMzF6xTAUNjDsXAAvhUc3lX9K+JbyaKq3CSHj:PRb1S2O06vDswA5Uc3lXJJbyaKuD","tlshash":"c1e2e1b69b46e35ccabdcc757dd00c4be97d2d4fea45f9f26f51040041d2002aca87a2","first_seen":"2026-02-01T19:03:24.140792Z","last_seen":"2026-02-01T21:32:25.637612Z","times_seen":2,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Roboto_Bold-s.p.1734e663.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Roboto_Bold-s.p.1734e663.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"28da8-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dYgtovVWLOev%2Fd9K6ddl996nO0F%2FWefEU27WdAfjbhGcmfB1X7j3fiAOfrQOoDSmzMsL35ttooLD%2F2JmgBRcRVB5L8TCj6Nk19%2Bpdr%2FwURhtv24lGNl61e4%3D\"}]}\r\ncf-ray: 9c73b4834f585ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":167336,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"GDEF\", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.137; 2017Roboto-Bo","md5":"b8e42971dec8d49207a8c8e2b919a6ac","sha1":"62442a18a9fe9457c1afeabf683d263a691b7798","sha256":"ec685a46105296fe46c8744da4a11cf8118ba6c11271941766f7a546df6aa7c7","sha512":"3bd40ac788d44626fd640ec67ef04ab0364816b5e8c831f2077bff8805cfe6890ca29274b476f933f6e96ddaa16f4e2f3f66c616dff7cd88cdcaff7dae8ca5e5","ssdeep":"3072:VBa9dX3CyiSB1/R7O0aXjC1YHeA9bOuPUPT9mYZK9K4N09PJ4X4HXYXXXXXXLnqT:uX6XiuMPT/eK9cnfST80/","tlshash":"29f3f501d2479629cac6b2787c3cd3be1970e429bc6ba11735e4af3149c8945ec69bfc","first_seen":"2023-04-11T21:48:33Z","last_seen":"2026-08-07T09:07:57.003644Z","times_seen":6332,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/4dbb7151aa13c217.css","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/4dbb7151aa13c217.css HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JNoco8FznDiNtH0nXm8kJFBwj%2FSoa3gZrO%2BuE7rINRDH4E1C%2BXgQLoLt%2FoPutQJ%2FBQOyYeQHjwbuDllAgJ6L0mQZwEUi2OZh%2FdNpnf6waG0sADtC1hgZYJQ%3D\"}]}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-encoding: br\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"1ed-19c15989c68\"\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4835f605ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":493,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (492)","md5":"2975df78ce897504c7865a17d86a02dd","sha1":"75622f0db777dac2055698abcb0eccaa45cd19ca","sha256":"20693b666c550b94e5c07cd379a3223daae26b6ae469848e707744ef33768fa9","sha512":"d06b67ecd2587ffc16184843f6dfefd72537fbc41ea2bcc8306cea2ba049d11d97700e0cf2a7a55df49058c1bed9ad9d44ef778a1eab7ec58ee5a00d7c57c156","ssdeep":"","tlshash":"4bf09059c032118930fb6a1a9ad4e76e1458c1c3718888fd76282ffa9a21f7d4369849","first_seen":"2026-01-31T21:08:57.22202Z","last_seen":"2026-02-19T17:02:28.736Z","times_seen":71,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/terms?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /terms?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b77b9399d293a88a-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4Jt%2B2Q6d32MnZwrM9vsvrL9lfhcnKlT1qfGCWxyjn2MhAF4u8ptws3%2FUEWoJoOYzxRww%2BvdoW7TR4xod8cFGfso%2BQDsjZC1qU3LA46zTtBQbwBt3Q7F%2FydM%3D\"}]}\r\ncf-ray: 9c73b4912a5d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2467,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (958)","md5":"4c4040922ef8238aa5319bb0a09a69cf","sha1":"0576bf92a50b96b6804a28f080a195bbe285caad","sha256":"082a29c0bba4535ea13e8e7249563e6f30398f2c9ebb0bc6b0a5c641669335ea","sha512":"029273432c418c1890843207b00d7ba09ab84cbaa0092cf4659e43f6a255872a23dfba77c966a66a2e93725769f9796e6f5a5453f7b146e32c41d97642423d6f","ssdeep":"","tlshash":"1351bf0dc909adb498c9d59961d5d7016688bf37f1b88dace04bdc64138f03d0beab87","first_seen":"2026-01-31T21:17:17.910348Z","last_seen":"2026-02-01T19:03:24.145017Z","times_seen":2,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=o26wp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=o26wp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a4fc9af310c85097-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=o26wp\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QnhOUgVHmzu9SveHzNq%2BYDgiWaqYb6%2BhFFoO2Y3qgFSMjZjd0pNEPzkCJ%2FA3GHRv5vMguAknftK0YO8No2KPY45dg9W1ezTUCwPalGv8QZeBG45Pf6NVpr8%3D\"}]}\r\ncf-ray: 9c73b496ab905ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52899,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (4880)","md5":"570897cecf26b86ba177a9542e030fea","sha1":"70b0af19246269e2e8ed8574a20fb073861d680e","sha256":"379f3154f2e8932decbc6b2b22c4bec8d1f27c9eee8eb6c9a086af7519510c45","sha512":"401baf134a9c2db68aefa871e46c4ebe2ec91d61a78bda3c66126682cadc9d9fe7e7691807cc4bf75f4d24e132bd140f4778994ab69c0d70affd3b9028639e92","ssdeep":"1536:lEbG4yk88Dwc5+4FNCGx8OQpKLnlxkN0a3BFug:lEb7yH80c5DFz8Xd","tlshash":"1433d665a71aedbcfc1aacad140f8335ba8d0db7de22cca9d3ac9d4403450245f592d6","first_seen":"2026-02-01T19:03:24.147984Z","last_seen":"2026-02-01T19:03:24.147984Z","times_seen":1,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":84,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/fc3bd7c39247c848.css","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.632Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/fc3bd7c39247c848.css HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"53027-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mHZMwGYnfv4ZPhVZr1trCeoYwWQ6vayZI1ocHFfNq6WgT6J8PoQJOKmIAxJtTp7B9Kj7VoCjE8pSW1lKqn57W7f4DYpK2icpGg7rCZxhIINYM71%2B8L%2BI%2Fpo%3D\"}]}\r\ncf-ray: 9c73b4835f5d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340007,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"57b3a1fc42725b3767655e2c5e1e3686","sha1":"a5f033187d6d8942dabbeb5c7bb6f7e01abc19a5","sha256":"7220b9aafafef2c5593b891b67bd48a5bafd4f4b4729eb23d098f09255d4cfc5","sha512":"e0be6e1bf967112ca7db7ace4fe5d08e7038ccdb10f0b80fe07906ced9f3458b28e8eb46f3eb9b9f8a4ca42258c0dd9091181b121122f6d0ef23c066f41c6790","ssdeep":"6144:ssaDL+pazxc/6x3jchVC8cxIwBolW+CER1NGdROr1WJWVgSBL/SZG51Ro5kJfb1L:rvRl95T","tlshash":"2974a391b119d1bb7e2ba4fda38cf8dcc108f082de764ba9f955922423d37f36961604","first_seen":"2026-01-31T21:08:57.268767Z","last_seen":"2026-02-02T23:30:02.779633Z","times_seen":75,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/7844c00c7b87d4b8.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/7844c00c7b87d4b8.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"4471-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N0jGUuUz3a8NCVEWucOwgy0ev5aQIdGSaHISeZrvlhMDv1rvGK0f0WV1mgkvVDyLGHMjTwKJM2sKBhMxS2fGLyUHIWRNKP9wpxpXNh2OK%2FwAcN%2FE2ONynfk%3D\"}]}\r\ncf-ray: 9c73b4836f745ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17521,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (17164)","md5":"f596bd85087ae8c7da24ce1771082c9e","sha1":"b7529d11179acbc5a77d79cf2cb3196e1dcc643c","sha256":"b8089e9f96c5d58bc21c3403009eb46a6d86ae550566419879b9615a439ba651","sha512":"fc9bf925cc24f25650d96a00d8acad75c7f110c1459c93473aa4e885f2347766465cdaf397133edf42f4c0fdbe22c42d36d0e352327382fa5a0be1efa1ad08b4","ssdeep":"384:Sjl699ZRlP6Xe9XEbp1k2PF/TG+IDCOa7f3flVC:Sjg99ZTP6Xm0bpfNbLI+Oy4","tlshash":"5a7229e02109793d909f118eb22a651d772d3a46e00f1838b27ddcfc12aded43197bea","first_seen":"2026-01-31T21:08:57.369086Z","last_seen":"2026-02-19T17:02:28.737399Z","times_seen":71,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/b699731cda0020b4.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/b699731cda0020b4.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"3bc9-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3ngDJJ5KuDr4Azln7KC8JlPLTVOGU1lAM8XhasRtxeOGC1Sm9xuWTsZxgvwPTn%2BzPTWTawYffOaPrnA5D4VAo%2Fv%2F5R8vB8GlJtK7a3qHq%2BKhrdiwwHQRjN4%3D\"}]}\r\ncf-ray: 9c73b4839f995ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15305,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (14948)","md5":"40440d0a26afb7694208aaa1124c32ae","sha1":"92e8a42be6d633c2e1600636ad212c413efc6dad","sha256":"5e5beddff18019122661132c259f1c8997d53a8136edaf8eff390948b963c9fb","sha512":"81a7ea351def4c29eebe87171688734b80801a7e40786a86a551687cd6bf81530a7f543c9fbc1fb6f4b42a857fa970238926bbcc24ada2c6b2b2d7389d2b0e08","ssdeep":"192:OqB5qeZR31Jm74v1o0n+K8jvZnSGQpXeXcBorSncmMcRD1o26Ss1RviE8VSTtrSF:Ooq8RhKnjvhm/p467EIa3XDoOar","tlshash":"ba62f7e576d2f071a3ba1ae6d03f0056f2691db4240d1010f369e4f9397489a86e7f7a","first_seen":"2026-01-11T01:55:53.572093Z","last_seen":"2026-02-19T17:02:28.75444Z","times_seen":73,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_Regular-s.p.b62ab84d.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_Regular-s.p.b62ab84d.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/_next/static/chunks/a85c5f2112ae0905.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"63610-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 1\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2%2FXXXRnn%2BdD7vml%2FEXtrMeGKQVt9j4IQVyjA9fTptbQ0d%2FZ%2F72xvA7gE4oiIqxM0tOpbwBv7pZ92tLtgoARR3KgMoz2%2FnSZnh3POSM8dPBLJfjUT%2FSi868c%3D\"}]}\r\ncf-ray: 9c73b48eea0e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407056,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterRegular4.000;git-a52131595;RSMS;Inter-RegularInter ","md5":"fdb50e0d48cdcf775fa1ac0dc3c33bd4","sha1":"5c95e5d66572aeca303512ba41a8dde0cea92c80","sha256":"64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123","sha512":"20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53","ssdeep":"6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08","tlshash":"30845a17e70ad70ede452e308af987c133b9bca1785a924bb59e3a58dd971f409cb0d0","first_seen":"2024-07-29T21:54:32Z","last_seen":"2026-08-05T22:14:11.394006Z","times_seen":495,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/auth/getSession","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/auth/getSession HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-871916b0f7696291-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 401 Unauthorized\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 43\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"2b-dGnJzt6gv1nJjX6DJ9RztDWptng\"\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BWvYsIMK1UMceeqSQvS8FQUG5v923mVLtcf4Eg4xHLfCqAX9jPMKE3FJV2UhY8XXCkKiOFGhN1QJ5bY%2Bm4WNUYU9FlRNGSsusfyUSvhfa%2F2Qy%2F42AOPCDhk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b48f4a235ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":43,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a35da7b2f88e0b2a1d5ebe0ec06102bd","sha1":"7469c9cedea0bf59c98d7e8327d473b435a9b678","sha256":"e1654c7ad9ce4df238c7c18cafe8b85a27ac81155501831fcb1583963308e9a5","sha512":"62b900bf1f8d35e3df1cac72810891745f874b0dfd4bcdc5da1a3f761cc1cbb934f7aa5c65f3c2692aa48860f0384333933fb3fa7d4051254ab4a3935f6adabd","ssdeep":"","tlshash":"f790040014043d3777514105710c5535cc13447c51411053154c453c45435c44007500","first_seen":"2023-10-23T05:59:08Z","last_seen":"2026-08-05T22:29:16.61742Z","times_seen":454,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/reviews?_rsc=lab30","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.795Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /reviews?_rsc=lab30 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/reviews\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-991d99be6d2f11d2-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews?_rsc=lab30\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zk2YS1pnxsOPa4vkq7KwbDxGNJmIO93iHVrX9AUxl5K40YvVCQNCXZxzf62NCxh4MgrlkTITGF4%2BOhX8ll2F0qbSql9WzI9lNzSM3S6jqLvAJoZ3hMrw9ew%3D\"}]}\r\ncf-ray: 9c73b4977bd55ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/mines.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/mines.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1734\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 18:08:17 GMT\r\netag: W/\"6c6-19b7abf0268\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e0E5q0DXeiMdLdQLTdoqDhudLLe%2Fzgd4ZswqYDiiwFrwMWQs4XeWvmo9VEanqwWz0tIEXvOdhcV7gt%2B7zf%2BTm0zGY2NtXx0uSmmlzzYRMniZ8XqOYR3B5Pc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497dbe55ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1734,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x257, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7fdb901c172b335aa0c59289d0ca1d53","sha1":"164b3ba4e8ef8a7f10d158a69f9f664e63085c6f","sha256":"a54b22a7226f14e4f83d960f2e8ae53dda7ba0ebe49587b1209ff36898e26bff","sha512":"633554002826f300bb24d88d9de30388a612c4f9afff50dc6aade8996a8dce578e4c7d0a98ae474dc83d1bf2ca0bb86a11db9c916f3c9d515b7a11ae414f7c4d","ssdeep":"","tlshash":"bf310b3e015b206166e29b6f633d17a48dd505c98eb3ceb4244fcea2ac14fd1d560f11","first_seen":"2026-01-11T01:55:53.426802Z","last_seen":"2026-02-19T17:02:28.799021Z","times_seen":73,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/bets/lastWinsNew?filter=highWins\u0026limit=30","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/bets/lastWinsNew?filter=highWins\u0026limit=30 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b755ecae4896409b-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MlbuRPvB6jFUvMcyOpSsmrBaR9c0xKe9xJPK%2BzfScLLbfrPvbJ2tEhLHkzRmVYd7sEZ%2FqA7nwJLIfjCkN3hZD%2FK20Xox43FS%2B%2FNtLdVxswUsHSe5h%2FzIJfo%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"1dd6-JO4C8vcxSQTKtM5MSeHARjEKrpo\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4986c065ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7638,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"eedf3d14a1de9b7686e91ee05ab8a0b2","sha1":"24ee02f2f7314904cab4ce4c49e1c046310aae9a","sha256":"5c642b569c49bb5c07599f3cd6d71bfa31e69c9063ca0fe55abbaa90914273bc","sha512":"0898b36547cad5dde7fb358589e118ce4ea9af532b2b618364b2a63c194bb18ad904f3705360e68a58923cc789642eb12b49878071c325050a6e763d93715314","ssdeep":"192:ozR9iopcQnfc0X8S+2ZG+Rg3xSGt7tZ0BirBKSesFZEl:ZQnUX1xZw","tlshash":"c2f1023a60bd1ca8901d0dc6b2c73925a4dd251728c4ce608bacdf3da2f9959fd066f7","first_seen":"2026-02-01T19:03:24.155729Z","last_seen":"2026-02-01T19:03:24.155729Z","times_seen":1,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/DMSans_SemiBold-s.p.432e74d4.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/DMSans_SemiBold-s.p.432e74d4.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"dc14-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JqpFQvIlqBG%2FK7%2FypuCHbobLumSgqnnj%2BzsFFUmBj9M9Hhv7yLEO46cNq7VbxIaW9ZzY75o1v1N13S8amvvTSzEX2gmE3Ede0d9K8DlSr1uGOlQZXzwYpAo%3D\"}]}\r\ncf-ray: 9c73b4834f525ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56340,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 44 names, Microsoft, language 0x409","md5":"41de6d553ba4b1825e9cf023e97e2ee4","sha1":"c2c26e18339912a10d796aee9a19ce1aff5177e4","sha256":"cd4f7b027bc8e71a19360a426cd694eb195f6fad4142437047f33b312a8c4e94","sha512":"e6b614a65c7441b5a6967df47b1bac808f8966ed8b43446fe91056235b6797653999b9160172b77bc92c2db35e411a1112e97071dc1ca8ee17a7b288357c6fd4","ssdeep":"768:8sVAWXhIU7ifzsuFE55E5bBvQvbKtdE68fjBzPrloGWJ0j32v6w51:8CXV7eQWbTn8VyGWKyv6wX","tlshash":"a9434ba9b316960dd356babc946373b483b0bd3caef3c35b54b1673aed4d0a14c11289","first_seen":"2023-10-31T22:57:11Z","last_seen":"2026-07-30T14:11:57.001438Z","times_seen":308,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/84514c7510b6b9ca.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/84514c7510b6b9ca.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"3d94-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zLViPegYivvRan%2BLSPlJYIWjFLJ%2Fh%2Bcoih9cc5e6m8Hlb5iTj%2BLayqszf904OKuoLDXj7lOiGQ3rr8LJuCQfoNye7ZIkQb75qbJWcKGNYdT%2BMvmwmtKD8ac%3D\"}]}\r\ncf-ray: 9c73b4835f615ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15764,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (15407)","md5":"d51af061e259b2aac980c62c2a581cfa","sha1":"25dc5232dd34515d64d445c772aa386d15a843bc","sha256":"a058a237f6dbe04d72f900d5ac0cd02aa6c68aad91ecdfe74aeb81a7c23b3e3d","sha512":"b9977395310e5f15dcb8b94e1034cff5d09ec28908599e6d68a3fdb453b3d9c805e3eacfd9b42d7a1e156027d445600a5c38c8d5f350f92a79494aef77e1bc30","ssdeep":"384:RqybOz+GjHeaCgyP340BAg9p/cZNRAUL0YvK6dD:Rqyaz+mlCgao0BHl4RAULBC6J","tlshash":"ab62f9e972e6fda383a74194843b0007f6280d76145ea4e4f7e8dcea356094e91f2f99","first_seen":"2026-01-31T21:08:57.197191Z","last_seen":"2026-04-28T01:10:54.101669Z","times_seen":182,"resource_available":true,"data":null}},"time_used":1529,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1528,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/438b3221d8ed98ae.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/438b3221d8ed98ae.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"176b-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZDkLCHPWg8m88qckmuaygH%2FwhOKwLRkV%2Bgcr1gJ9jISTinJCTGkvgIkLhO%2BDFHWGUy6MEMKBa3xjmeHKJhKdxQPWP8tKV%2FAs%2Bn1kfPARuaEOkdIJ8HukGrw%3D\"}]}\r\ncf-ray: 9c73b4838f8b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5995,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5638)","md5":"776e994809ee498e36929c1369e977ae","sha1":"bb87b2a8cad358a2b6b54008384ada9992d775f6","sha256":"d7ed199cabbda4d46f786e339ce99c16a7127aefad702bfc2e779527413fd749","sha512":"505e54da0c580cb4f6d9b2143e1d83e793f10296d84465dcba72442c15ba4bb2fef4385bf203f10566f6f2c935c91faf721172b36cec84945fdfd717b3ed9df1","ssdeep":"96:fWKeBCnhISV+FdytrbbUp+nOliRqCWj8HpQd4roafQBoabmj88p+qjFfww2R+Rg:fW03V+Fdwbi+OMLWjwdlpli9R+Rg","tlshash":"07c166e7b7c433a1904d437052237112b2be39bf33cfd9a58aac85c4595d84ca62fd8a","first_seen":"2026-01-31T21:08:57.243873Z","last_seen":"2026-02-19T17:02:28.633034Z","times_seen":71,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvg5l4w\u0026sid=F5kFgPvxx8BidtubAA3h","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvg5l4w\u0026sid=F5kFgPvxx8BidtubAA3h HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: undefined\r\nContent-type: text/plain;charset=UTF-8\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-90a0733e433eb38a-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nContent-Length: 2\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"40"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KVPMIRKcjHtdr1dfhkPstcnZcSHXJaqyQnNvFQklwKRZ9st5UCkrTrrenzWcXGkbdWL0J3M43QwILq8T7w%2BG2hsY47TSma7mlOHOGqgBaLbuhl8jSEcfyNA%3D\"}]}\r\npriority: u=3,i=?0\r\naccess-control-allow-origin: https://postfinance-user-auth.com\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: no-store\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4913a615ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/html","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-08-07T14:06:02.598621Z","times_seen":446277,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/bets/lastWinsNew?filter=all\u0026limit=10","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/bets/lastWinsNew?filter=all\u0026limit=10 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b9a4f07c11536c0b-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KD2X4faBobknPrA528dJViLEzQUjLmMNRekLFiUIWRgltcqGAMiMJvJFvpgXU5ovQ2OyorclLVT%2Bq3JrEGhz0BgI3agQ5%2FLDjGLgCBFUFxVf6X4%2BY8WiEf8%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"982-1qEBwG8pGQ+qmC7YUBNAT2JZMFQ\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4987c075ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2434,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"5d6a15bb642001832efad604e82b5321","sha1":"d6a101c06f29190faa982ed85013404f62593054","sha256":"e98788dd8cd6072136ab1725e4594d7530bae24576430180b75bf547a64a026b","sha512":"70870600a779872353425badb6afb08c25e27603d8350070f57fa130f63e0286c9f9770642e11be641bceb7b6ad547d8d08bf89f92ec879f210f577306bbc8a0","ssdeep":"","tlshash":"8d41de3a24b91ca8a00d0dc2b1d33925b4de65172cc8dd518a6cdf3da6f8c49f8155f7","first_seen":"2026-02-01T19:03:24.160444Z","last_seen":"2026-02-01T19:03:24.160444Z","times_seen":1,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-zeus-vs-hades-gods-of-war.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-zeus-vs-hades-gods-of-war.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49074\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:46 GMT\r\netag: W/\"bfb2-19baced3750\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O7nrCyaBWf%2B2PNfMy9kJC9jTzGz7S03UedYOduDp9Kv4XK5frj%2BB2p62Gl%2BVWTUJYqGh16pRH9pQ5rXzVaHnLet1zN4O459llNfaIQ%2B%2B5Dx1gzxloTesGU4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c445ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49074,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ff682e6a400c4bc05791fd54ef83d681","sha1":"8bb50e03f92e4510a8749650368f7444cf067a55","sha256":"f785bb4fee9a1aa1a7a2a33527b142d1d8013b2cc28382453512c4dd8e3fd040","sha512":"86fa8194b0dc72fd557beb652aaac87a16ea8e493742388c2f748e349fe639ab5699ea358bf31c1b442c4d6984c35ae83736d77a294c91cfa5c94c00fb175800","ssdeep":"768:cKnk4UQkSFRzzBcSDXOO/Id97/hisxvMg/AirfXiss76ZXF4DJc5py:cK35kQX5D+O2N/AEvM9UKss76ZXic5py","tlshash":"992302f7c1d4ce58c1744035a0e3e12b4548deea29505c1dfabe1fc84c528b6922ebee","first_seen":"2026-01-31T21:14:50.70563Z","last_seen":"2026-02-13T20:55:00.827393Z","times_seen":35,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-floating-dragon-dragon-boat-festival.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.446Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-floating-dragon-dragon-boat-festival.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32766\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:10 GMT\r\netag: W/\"7ffe-19baced9510\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7d5td6jghniQcYEE6DEEwVJZPXtC17TEjWO9EmxkR3QtFvM1Adb%2FBPyyU2C%2FUVqW%2FF8e5jr5kvVpow2%2BqEy3RBbWyQ%2BUH8qres5ssk%2BdDUI8CtxGPno%2B034%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c805ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5dcad7deecf6af5bc7b1d2194e313a70","sha1":"616cc3e62c7458645bd0005eeef5758c1c3f6386","sha256":"b6f1654f6e689dd5a299e4d27d7b678b309ec6adef39401c629a8daa10186b9b","sha512":"613e5d0553e9d3db2482edd15b625f9e26f0d0647a81097402c82eb5f59362d9616093428e06ba5adbc76f0cab52294edba4c17811ed788a613c2afb9e28d7d4","ssdeep":"768:rhOlIkG9JpLs2lJl3+PKC9t74IcusHFfaS+TCEvGgQcCRWY:FMvOJp42lJ5TuKfVOvg9n","tlshash":"bce2e0016b64d910c928f5b151edd51aeee71f820ca026947a9e94035f982ffceafc87","first_seen":"2026-02-01T19:03:24.163089Z","last_seen":"2026-02-02T20:55:17.566298Z","times_seen":2,"resource_available":false,"data":null}},"time_used":429,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/about-us?_rsc=1i0dl","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /about-us?_rsc=1i0dl HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/about-us\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-89b8ea81d776eaed-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us?_rsc=1i0dl\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FD5X0gijP1vYGYrwLF2mkk%2B3VQJXNBMq5WRskx3lIPR43zP%2FJAjJ0oYdueiQDTB3A5UP3CwRwdq73jIQUz3toHZkagd24o0mpesV0XnajzWlDufhkf52h4Y%3D\"}]}\r\ncf-ray: 9c73b4a00d565ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/83f137a05a633d06.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/83f137a05a633d06.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"54b-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sqrkkW%2BlPJu4sEr5z6ep8FWtmU3CqtxHiA8%2FtO5hZyeAJSZS6PAKq7GJ67Xn1%2F6LPGHLkNPuz7%2B9rDRd5J8G7CJ535PJZZmkGtl1OluwY%2FzwvquzJN4cjIA%3D\"}]}\r\ncf-ray: 9c73b483afa65ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1355,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (998)","md5":"d71a9dfc74f1b0837eaf1c0c2ecfc840","sha1":"934dd225917e22545e4aa04118d7aeb28a86ccbf","sha256":"cfa807758de5d91ecc7139cebc4af03b69ec8a02410589222ec6bacea664be39","sha512":"a7170c749edbb15a4d2413673dc3ac0ca9a8daa21720a10db769fbb5189ede64f0d080f60e44f9d2bcdcff4d60ce046afc472aa64b9e722c6c2b11216b3f0d09","ssdeep":"","tlshash":"db2186980310a5c4b1be11d9ec3e410b702514b79b4d95baf0fc2c3a2b140c5a9d0fea","first_seen":"2026-01-31T21:08:57.199938Z","last_seen":"2026-02-19T17:02:28.759612Z","times_seen":71,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/flags/?v=2\u0026config=true\u0026ip=0\u0026_=1769972569490\u0026ver=1.318.1\u0026compression=base64","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /ph/flags/?v=2\u0026config=true\u0026ip=0\u0026_=1769972569490\u0026ver=1.318.1\u0026compression=base64 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncontent-type: application/x-www-form-urlencoded\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-af21d76039f33e30-0\r\nContent-Length: 277\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":277,"data":"data=eyJ0b2tlbiI6InBoY19UcEhBQW9jS3ZlRUlIVTJZZVd4S2Z5Z0RvRVY3TEMyYkNxNG1FYUQ3bHVOIiwiZGlzdGluY3RfaWQiOiIwMTljMWE5Ni0xNThjLTdmMjYtYWZkMy1lYmIyZWViMWIzZmEiLCJncm91cHMiOnt9LCJwZXJzb25fcHJvcGVydGllcyI6e30sIiRkZXZpY2VfaWQiOiIwMTljMWE5Ni0xNThjLTdmMjYtYWZkMy1lYmIyZWViMWIzZmEifQ%3D%3D"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0FQwRL9gWd%2FV4r7ONNKcYyoLi1nNxdSkoIa%2FMVy6Q3Oc1YqUugFbyEkv0NZf34lXmmjoX6NYYqh0CFT2eS%2B%2FfExyvxW2i647AbrC%2BxIRGIWG%2FBtfs4J4qQk%3D\"}]}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncache-control: no-cache\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%7D\r\ndnt: 1\r\ncontent-encoding: gzip\r\norigin: https://postfinance-user-auth.com\r\npragma: no-cache\r\npriority: u=4,i=?0\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: empty\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-af21d76039f33e30-0\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.64.209.48\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\ncf-cache-status: DYNAMIC\r\nx-middleware-rewrite: https://eu.i.posthog.com/flags/?v=2\u0026config=true\u0026ip=0\u0026_=1769972569490\u0026ver=1.318.1\u0026compression=base64\r\nvary: origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://postfinance-user-auth.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 44\r\ncf-ray: 9c73b48f5a295ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1428,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6473fac7f5885147972c338f4e0e9e4b","sha1":"76e1bc16fbb9e7f1ad6df9aced5787878ebc4f98","sha256":"3e3f95bba878a99b118f06d8b5c6219d43945182f7d29a39562959e15d4cea49","sha512":"c034d229b883f2ba9baac3fc6626a1fc22802b5bf84901f7f470d3d85070054ccf570c758d1d9a8cb9e90a84ffbe218d5c4ae0197406547f46571bff98cc355d","ssdeep":"","tlshash":"3c21e13abd206877844ec3909ce9fe064fbf133716245c0498894a3853e72f9ba67d27","first_seen":"2026-02-01T19:03:24.165946Z","last_seen":"2026-02-01T19:03:24.165946Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/providers?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /providers?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-92e72775efb4b400-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HRJPmsvQd%2FbXFCfmR0L7nIk1VO%2BkE61TuxQvK3mhKKcHMgrvA1q2cxwyQ7IVjPs35ZICCH%2B%2BRe5i3oyY37Y259PKpMgLyUb7prwCYQ6lRwbemfHVfReoA2M%3D\"}]}\r\ncf-ray: 9c73b492eab65ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2475,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (966)","md5":"8b264a30166c47afc3714e1d5d6fd650","sha1":"bfb5a9ce94f08b2f6074ec111b903908b6c04c56","sha256":"8a95614d9bfe0d903846c260be12084a8b0d8ab2e2cbbb41217baa39d7215e6a","sha512":"24357898a99e4672d213e5dc987034dd3ea33b0096a21d267a287488425244d1e69e59f35a75b6473ccca022c5a38baf585a0dd69932d614422ca6c8e6e3a8a8","ssdeep":"","tlshash":"0851ae0dc809adb498c9d59d71d5d7016588af37f1b89da8e04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.915143Z","last_seen":"2026-02-01T19:03:24.167753Z","times_seen":2,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-wild-wild-riches.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-wild-wild-riches.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28626\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:46 GMT\r\netag: W/\"6fd2-19baced3750\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=os2TO4vrAtjDpImBQWPi5rN6zrlCRAEzd1Nzu0Im8DFtsz%2FCRSJQVHBz3db19wwMywilkz%2FhWIBC%2BjRm7Wnw1PS53o4vMBaqeJtWy37SJOSiO0cGHLoe%2B2k%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c415ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28626,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"41b175d332e2d248c879b133878541ce","sha1":"f7d2320a8cebaa7901f08bc7142b6027c942e0bb","sha256":"a3997b4ba92bfd35ebffcd0ea0d78a362e125558b02d920209e5ea07a073e50b","sha512":"84d2d229d9cfb7902fa3b425d74938a397f4c2ed7aceaa51a84e0cbfa88e6d4fdc8eed3c78fbfd364f1b143ab4170620c56b6da626db16b1f56766e76d6faeb0","ssdeep":"768:HYVLqT7LmTKFfU6jkEKrLicFXE97QRabMO6Kzlc:HYMPtfwEKaAZaPbS","tlshash":"13d2d1d14f31c2b0e26f64bc31adae7a39b839aa6e7c85d045b12c4e75805c358bd7c8","first_seen":"2026-01-31T21:14:50.7445Z","last_seen":"2026-02-13T20:55:00.75998Z","times_seen":35,"resource_available":false,"data":null}},"time_used":1138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1128,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-master-joker.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-master-joker.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29036\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:47 GMT\r\netag: W/\"716c-19baced3b38\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1tUQrqLBtgYlOfiNmEM7b594XOSftcuq385P6%2FPyY1rXbJWgzbXwnRIh1IBxK6btp1nc7dLK9hAnffrNkj0RlMomjvAg0jGsx%2B0cZA%2BrjqsaENAm9TZ3FdA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4999c455ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29036,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3094e21d59f5cac448bbc2f0cab09182","sha1":"1050e322162a7e7ce0545382e1606a56618b397f","sha256":"d93f2ac7f9a08d05e70310a2cc0d88bfe80c253870b0633d2b04dc167bc67d56","sha512":"cd5404737f5b1530f0b6414075c9a666fd5baabdb3f789ecd09c7a61d6f7c4c5f87e009da9cc64a0d7b5886962ff2cd9d81a031c3d548d513e633acb791f4c62","ssdeep":"768:PmSbnTLBKAIUvv7t5YD7+J5qqhA1hkykbcwn/X1lL/N:bTLBKsvzUPM5Dh/cIlJN","tlshash":"07d2f1be2e6c1b50d348510480a92bbfd6fff994930c74a28187d8bb4b87e44b491b1f","first_seen":"2026-01-31T21:14:50.658918Z","last_seen":"2026-02-13T20:55:00.781805Z","times_seen":36,"resource_available":false,"data":null}},"time_used":1131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1106,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/hacksaw-phoenix-duelreels.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/hacksaw-phoenix-duelreels.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33948\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:52 GMT\r\netag: W/\"849c-19baced4ec0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TahqFlwrjGqLQ%2BupJvfVNii4gN7xDx4HMWmJIc3asmNX5hl5qiLP32jtSbcOpXgS1qadklLsrrZ5AvNPmXuZYClL9oLRmlEd8IhHHcY791W6wovFjkLuM38%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c855ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33948,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"600db4b97ded85df57e10bab0bcf009a","sha1":"19153c41a2b008c985de37da7caf5cf63e581010","sha256":"39f15688354f461133243258510a97ee47a5a1ea7a77d1ed603ae4965a64bdd1","sha512":"96e77fe1bd0ca9c66ce967a6a7bc143d782289316a97c7a3c39e2bc4064796208d672a27a315e54ca45fe7a00214f4e7bf2d1ba101040853263d7892f768d457","ssdeep":"768:A+X2f0uGSw4eOLupat9QpUjDSLjFDwSV/5KqKyIy6xi8:A+XmtHeUu2OprjFDwAfTP6Q8","tlshash":"07e2e1adc25c2b66e84684c61c19efb07048dfe82f533b61d06fb5af7566185f2ce448","first_seen":"2026-01-31T21:23:44.441517Z","last_seen":"2026-02-02T09:41:14.687625Z","times_seen":4,"resource_available":false,"data":null}},"time_used":533,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/platinum4.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/platinum4.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7034\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:45 GMT\r\netag: W/\"1b7a-1930f246a28\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eGNyu9t1LZnUmVa1HWoL5DxUnXLd%2FtvkVwUbEhJ%2BGqeUA08uA%2BnWhU9WYg9L4jm9kmb6aA%2FmPA%2BHProHsZz2DRatvj5tQEoLO61xa8uCocV4hUOYYHoZU00%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b7c885ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7034,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9e0bc3fc285e85b799724522028cfb8a","sha1":"8386e640d367cecdac67b4737ede83f6475e7407","sha256":"a9287616ece0dfbb915845b2ff11fe7c2e6d97430e239a83b05fa95c2adc241e","sha512":"de7c205388caf17e287f63f2fb735c3a85600bbe32bf8750c6c665979720d2bb05007fb8b51319f8ff4c5afc83e3449a3a519208974b36f993f63faccdcc73da","ssdeep":"96:cQoru9pqWfpPBT1o7VarDNy6Vis49Pwp0oo+M3oyOK7WHji5/PPgAc+DyeaTGJci:/WH47o7VIYsQPwp02MGK9vj3haGmov","tlshash":"d9e1cf3f659474dad9f10bd978e7e4670e8895b72d58360320e7faa3540e38f883009e","first_seen":"2026-01-11T01:55:53.516394Z","last_seen":"2026-02-13T04:13:07.558506Z","times_seen":32,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":530,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/8a9983e0eefa6ffd.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/8a9983e0eefa6ffd.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"723b-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DAlEIsYdNiN%2BkI%2BjvY1%2FUTsSMBEzxZM%2BITFkrFHs1WxfHwpeNesUx2cnUjkAi0nMn7NCSrGyijxNVJ5b%2BDkhkG%2Fc%2B94evUpmtaYux5e7BbTMQKSxYPY1DyE%3D\"}]}\r\ncf-ray: 9c73b4a18d9d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29243,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (28885)","md5":"1e2778cdf6269909553d3706405b77a3","sha1":"aa1028f797111fbd2ac1fe8befbc5fc3ced497dd","sha256":"e05ee3375ac81e36ce934885bd42fd26f7873892d52da992947b6ca7ca198772","sha512":"8343355873776a7f3aa490a93a9d79e43be7527396f977f53e07ec8552e29b4fefd257638ee0c3e1e4ca1f9df0080d4bae32bf866763876a99daa0d247e9804b","ssdeep":"384:fBNKeDneohgZlz7FSwiSCD7jVCdBLrS+X1Fv2bTNKcjGbvYekGLLoo+eqfQS5y:5Nurxh54fVCb++n2babYVoNqfP0","tlshash":"04d23f159165bbecf53b04b8ba6d806c721e9b54cb0f8939f5b83c311a410d47a67bce","first_seen":"2026-01-31T21:08:57.384918Z","last_seen":"2026-02-19T17:02:28.621203Z","times_seen":71,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/c581bdd7dbf758a8.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/c581bdd7dbf758a8.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"9f6-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jj4HYfctHToIUXfLS5DR%2Fn9miXGPPx%2BudsY0UtQ0qfFoovMwoQ5xd3uspzL%2FV8KEW57CDKhr1APYnDlBEWeeWQ3T%2FO1iTSFi11Xenp%2BQ%2FXLoMEPJLAZLfGQ%3D\"}]}\r\ncf-ray: 9c73b483afa45ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2550,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2193)","md5":"9ba2df7dfa4c1e2e0ca7d8cc1e50c03a","sha1":"2f3772527d36b0f944eb7cfa65be65550d061adb","sha256":"9100e90e66e36e7fe0b6f0729980db3e04d2aba354215302085d03cf81903a89","sha512":"c5363fa9dd717d7d4031f0a7fe9c223bb416331d80bf45e573c28c3ef32f6b30e64427b3fd8b6031d039ba27503cda28c231b5e75d42283ac3c033c699d02c43","ssdeep":"","tlshash":"e95176543054776a25361675f02f0119b36e8a75031c6a62e5ac34fd35218e8db5bfcb","first_seen":"2026-01-31T21:08:57.231593Z","last_seen":"2026-02-19T17:02:28.722851Z","times_seen":71,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-big-bass-hold-and-spinner.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-big-bass-hold-and-spinner.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 26032\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:09 GMT\r\netag: W/\"65b0-19baced9128\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yBHrDwPB56SXvH8MJl051ralyFqfOx07WGunlMPp1A5xYc0gn3ZmDzEET2tY5yq%2Bzt8s1z8vLc%2B4VOG8qVNOCdufJ0auU5su7l8NmfOUso%2BcsTKInQKvpL4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4981bf75ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26032,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b404ced3704441a9d89bccff6e71cce7","sha1":"c46227a3e6ccbd55e65bd017a1e2c2cfcfd1896b","sha256":"63ed6c5717ddfb06722d403c141818e16f5f204e700d40d8e3668a9a873a0678","sha512":"8b7947ca509210d1415f43ce3ea02ec1c637ddd901aef6cf3a59ad8830a5dcdc44d8bbdc2abfb3cea58bb46de539491113e6f1441e422a737d9c6b6a5f248a52","ssdeep":"768:WcNwrDEfN5yAxmY1FHFdDqWKu2pnTuEkmHNEOGID:WJYNVXD/9KnkmJ","tlshash":"adc2f13c29a7aa78c5a77902f54b2e5e77e1fc80b10aed7f1d682741374183d026ed18","first_seen":"2026-01-31T21:14:50.674341Z","last_seen":"2026-02-13T20:55:00.802017Z","times_seen":35,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/bronze4.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/bronze4.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6582\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:16:57 GMT\r\netag: W/\"19b6-1930f23aea8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6sPiMTlffgJpx506c1%2BjZOI2QwCTpSLi9LVBGkq6eBXQzxauvwgEyRD9YiK5gEOQ8jmOIiIunoT3OA%2Bq6tjpVxItFzLF%2FMbDS5rygNz%2F2H3X0OmT7Iemh3o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c7d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6582,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2a153962749a5459ac17875a0baff838","sha1":"bc29c37a2ffdbe7656dd9e9ede3a21908038a17b","sha256":"ba213d43d47ebdea2c5b427b4b2ae52909634ab1c93b0314a56f43d6d151c88c","sha512":"685f2826ee3405662169d931fe00d56574f960af891d081083baf3967f0bdc4a03b926f3756b8959da06d0b37d51af0b1385304025a0d67fe99018b18e7c797e","ssdeep":"192:Bnl1O9Y51wWSQN8/4JFxTYiCDXJAR3qsfK73qSv:BlU9YX6/4Px0iC8fK7aSv","tlshash":"a1d18f5d6c4b1532ac478653aeeb9b4017f29c82172ae7cfc2221abdcef185426d6423","first_seen":"2026-01-11T02:03:05.502475Z","last_seen":"2026-02-19T17:02:28.792123Z","times_seen":27,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":491,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/privacy?_rsc=rfv7m","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /privacy?_rsc=rfv7m HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/privacy/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-bc21f1b5b3db842a-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy?_rsc=rfv7m\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LnHwGeaU5BIhcv0I%2FwAt6ep8TK3Z20Cs03i9hnOpN6GkTyKYBz508IkId59kAJkKL1AKkHUMC1kKkHwHiDzOXMYsfz%2FKuhq5ZYHg9RtvAGlTQ6jLlFlV0F4%3D\"}]}\r\ncf-ray: 9c73b49b9c965ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21098,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (3966)","md5":"78b5549f012a323317578df053343a9c","sha1":"1472b7e122fefe6ae5e50f5b48f7b13d60a35b13","sha256":"8e235cfd3caa316d509e57a908a814c08858ae6ff15bdd57b7ad91e521ba5ab2","sha512":"f6109c637cf010ccc1dde586306c9ed39a2c1c65b38ae64b9db94e5127bd87a6d795806b6c96ce6a0933cfe25e32dbac48fa407492b7539a2c3746e08480a97b","ssdeep":"384:ynzExz0OHCbG6dehOEFgWS0BAXexTrmTUtSZGyWet7Y9/LpyQIIvoz4meGpy34A+:7z0vbfdeEEXYGhL9sevM4mhyIswh","tlshash":"2592c81ed704a7a85b6b01a13a1fd7bafb2d4139bb62ce7a69bc861403465341f373c4","first_seen":"2026-01-31T21:17:17.937776Z","last_seen":"2026-02-01T19:03:24.179698Z","times_seen":2,"resource_available":false,"data":null}},"time_used":582,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":575,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/privacy?_rsc=1yiq2","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /privacy?_rsc=1yiq2 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/privacy\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-958db09744dcebc3-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/privacy?_rsc=1yiq2\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kpme2g57MGz6iYavpjK2WqnM8Q%2B5SwQeNakvk7xq1zDbeOZmzmBoGk13cBvzIpiiAL%2Fq37kX6iyDIpO6D%2FDis6DzrXo8wAxwJ1Cri1OLzkCsLlDDPdLEmAM%3D\"}]}\r\ncf-ray: 9c73b49b9c955ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":558,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/vip?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /vip?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a03a473bffe45090-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=spm7lcyE07Kuq1KjBRIY7fHjPJOo%2B4yUNg4eTdn1UOFTNCsCngWC7ImTAsh4Mu3qy4nd2Uj%2Bu%2FIuew9AZ6afa76gOC8uufAJQwXSUGK0VhrYjoiHEqpeBfY%3D\"}]}\r\ncf-ray: 9c73b4a0cd7d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/b56bfb8753f2111d.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.403Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/b56bfb8753f2111d.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"7175-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=39iHEQGKSbCSUExakrBDYXKmMo1J%2FwHRIbvpUJs1If%2FTpwZIMbyY55EN3mK5c4NmoNAS0H0384j6x0c1OxshobCJojxL6BdIjoLpYAf18JrlbTEjD%2BhRjJg%3D\"}]}\r\ncf-ray: 9c73b4a18d9e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29045,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (28688)","md5":"5e68a13c76892f30a85efabb13d82ca1","sha1":"966afd56bd2dd10ac30443a969c57de7820276eb","sha256":"143ac296f86033ddcd6f04439e75754aef4136412b75872a710be987fd05f423","sha512":"7efb5a92b6fb9e7cf28fe24b78c7cd93aaa393bbf28dad89e0445c7790de25405e6caf21dbba8602c134dc70d37361234d9425cb1487dee4b6e331616451ac12","ssdeep":"384:u2HyPM3ojR4oAQgGTH1BS8UEHMupcS3hHgrhiiGE6oSmLSpfz7SG2n6:u2Hy4lCHdMup3hHOiiGN54Spfz126","tlshash":"b2d2c7e33112f4728adfe2efa0a70466a33d26189409453c7d7a9d8d326d6447297f3b","first_seen":"2026-01-11T01:55:53.570094Z","last_seen":"2026-02-19T17:02:28.73521Z","times_seen":73,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/group/slots?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /group/slots?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-80ebdd5a98e86428-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iqtgF2zM6Iuk7KXF6dE5XXHWiqCe%2FnHy0RYKwDEpP%2Bravipr8EH7BrIRkX3zc7KKNBNzN%2B6reukbZlorM3t4gV1Y9tCMPM%2BorRtpTf4nIWSbbtyJ5zulbwQ%3D\"}]}\r\ncf-ray: 9c73b4a18da35ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/gold1.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/gold1.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4380\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:18 GMT\r\netag: W/\"111c-1930f2400b0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=995K7owIYl3HIiVLEMhKyFnt50f%2F2ZkshCYv5zAZG4hI6AVgzFNY03cDMwn93LPkQlHkMlIQzcuIlCW2rCKxi37bWs2hURGGJZfskec5ImvWPCfsLj70%2F1g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b5c765ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4380,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4871a0b3d8917103a4065168871efb6c","sha1":"24979179b5552f93960f58bdf2424126cf9264e9","sha256":"99ead3aaa178bb7a6a47fa72360d63eeef7e6c696ada3723c46eb037af123cd0","sha512":"99942d13d1d4bf95aba55f11b993180c8e0524a4e4542ab22a2908b081374686bf64168b425cf250024e941d6153066564de6a3e95fe08533bb16594fb36cc99","ssdeep":"96:h6xb8++AODzmab0uDAdundO09zFsgeoQHFzE+4Lpls/:4xb8++JDzrb5LdOaFJe/Ovpls/","tlshash":"57917d259ce887d965dc09c9fb4af177269269ddcb27274dcea0b913412a002c3ad6e2","first_seen":"2026-01-11T01:55:53.57397Z","last_seen":"2026-02-19T17:02:28.746334Z","times_seen":34,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/bronze5.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:03:01.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/bronze5.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:03:01 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8686\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:00 GMT\r\netag: W/\"21ee-1930f23ba60\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=34%2Be%2Boe7T%2FS1g08t914aYViDo%2FSuANvAfI9D%2BeCLVPrjczpEhvlRSaX1boPyMHo7sIcC7r4nDmAkoNvC8i5wDQ2DkWLOoMu0z3Ql8%2FKjLSEx5AGDln%2Ffh5M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4d87f5e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8686,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8bb7c24e714a2343bd7376bcececc28c","sha1":"dd8e3e1bac6549f1c2c07301161445a8e204c576","sha256":"e6e730671b9e28a68c484ad224ba082be47b63d6f50d35058be5c8749d149994","sha512":"a0406c763f49f304b3283e093246d2684babc785b22caba33919ce2a0458673506bd49ea27d0c532c4dcf0a728425082cea0032085800b7ada2e705a253b33c3","ssdeep":"192:mFYCuhhN8kts7Y9iA8xIp/9LTY/EF/n6FBZdVL1a0wgH1qz3dZPBB6:mFYAks7PA3k/EF/naBZdV5ahS1O3ba","tlshash":"d802bf64c24c5b930cd8b832057ad21b3bba1a0d6ab4ccdf44652537cfdcf8296bda44","first_seen":"2026-01-31T21:22:35.122467Z","last_seen":"2026-02-19T17:02:28.646712Z","times_seen":31,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":96,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/5664bd740cac6a96.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/5664bd740cac6a96.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"12cd-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wS%2FqHaYejz7VjlR9om9575kBIyqxq%2F7yXH6xkE8sUr%2F0EPPUiBZLh2iV4ikz15qmBHGa1h2a%2FADjMLx%2FXp0J3%2Bxwi%2BbzBTIvQDm8xkMli6lhC4N%2Fcz%2BX5k4%3D\"}]}\r\ncf-ray: 9c73b4836f735ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4813,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4456)","md5":"838e5b67c708c3caa4ccae2ab6eccfcd","sha1":"b2666226e6fb839315d216fb69074265386b6b8a","sha256":"3afd0a23cf42518fdca2dfc42bffe1b2c611189b89799ecbae2386434adc8e3f","sha512":"845acf9755edd329f45184ad9bccde9249a2018ea514934ae462a84992c69b4db39d636b842de7d5c71b9187c3e2fedab2b41095dadbbfeb40a683b3f9d8c76a","ssdeep":"96:p7ctuv2BtSDxfARZ0kqJFv2H43uuqoE91YTkqdYqiEAXjv2YM:oBtDRCkqJFezuwgYjlXK/","tlshash":"d0a1b6b231a0f490d16b4294c03b441eb27a2d3e609d71b493bd8cfd67e544de6a2f97","first_seen":"2026-01-31T21:08:57.248038Z","last_seen":"2026-04-28T01:10:54.184543Z","times_seen":182,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/e149492fd2b771c9.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/e149492fd2b771c9.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"1f57-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HHai1e9ioujGDHX7AmQCOtMsYNJS45quWvVv0QQwchxRMzLk9h5CyEgnhyxFrbjTa1wRhy2q87ELd2a%2FlTnyIlhg0hEwlmzek9FlxD%2BvuEvXV0E4fF0r81o%3D\"}]}\r\ncf-ray: 9c73b4837f895ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8023,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7666)","md5":"5a12d44809162192ba73b80f8c5d0fd3","sha1":"e293050209f77b727fffe4ee9d1e7371ae845b70","sha256":"ef08e4d8e1f121873218f8b632fdb4314da0c291d34f5d2772c01dec8a24bd09","sha512":"3bb9845b4093a49bc074853bdea0a895746e2451f8d236f40f0c96c103fdfd929e79525719bcea7bb997c7fd3ffbf1c3a2875fe3bfcf6b7f37a60eaffc92de55","ssdeep":"192:/vmIwuHfoWLfIaN6igj74xSkZiHV/ZoOR:/rHfbLfF0j7tICZb","tlshash":"20f1a5c613a4528cd4c64658ef739850731fa47f7aeed5d08a8ecba4b58b8c4f603859","first_seen":"2026-01-31T21:08:57.304794Z","last_seen":"2026-02-19T17:02:28.859329Z","times_seen":71,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/games/home?priority=none","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/games/home?priority=none HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nAuthorization: Bearer undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9a14f1c032ec4045-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IglXfrcF4YnZBIKSu0RmgmcsjVoY74oXeLaBNJVrcka3A4U8kSEwKfiI8h8z90m6UQ%2B0UdLbi2j5rGo1dx%2BItn0ScYRTxd99tGUBw2Yl8YyzKiTfEH8zJRM%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\netag: W/\"3410-JNmIeLScyJBkdyghxazxaB5xLR4\"\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b491ea865ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":13328,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f37feab11f2d0906ad163b94649f6c7b","sha1":"24d98878b49cc89064772821c5acf1681e712d1e","sha256":"35af18de983a7e1faa9d59f497369e71795f5bedcd3c9f563a62350805f00084","sha512":"b1a4fdf503906783f78faf9e8bdf94c4531ba69e9973a0a9d2966914ff5a0cde2d36f31092d4ec571ed2af109821876ca7d94206e2d205d34e1275015918d4d2","ssdeep":"192:Neof7taL3t5NEf8JmxEPv7a29G71GDu4AhiEIT8rj8:9azS710siCw","tlshash":"d652bfbac4954ca9435f6f0110c72d0ef4bd2e2331c81c69681aee3cd99ed97e60769b","first_seen":"2026-02-01T14:19:43.942168Z","last_seen":"2026-02-02T20:55:17.580137Z","times_seen":32,"resource_available":false,"data":null}},"time_used":908,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":772,"receive":136,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?type=originals\u0026_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?type=originals\u0026_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a3cd0ebd81b46a78-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-nextjs-rewritten-query: type=originals\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?type=originals\u0026_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8LqShM0cyocDW0e6sex0YBo640WpA6P2Liu7a%2F3wbFarrP%2F5HKN2zBQ5pkOPjTJK6aLx3p3QncTILWmCSRDp4eahkPScJZHXvHjn1p8TRBssoCxvd2OXC6Q%3D\"}]}\r\ncf-ray: 9c73b4946aec5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2345,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (836)","md5":"2629d011e4832eb665d489bb192d844b","sha1":"8b2f717455b65a79a67ea9850eb981460d9f1b1a","sha256":"710aa66ba1747d8d0b9eb67008106c47ada9f6be8e7b091b48cf8975080ec629","sha512":"306ce5376dfa37f17c4dd3764f33471d3f5e7c30d78b3ab2a01f1ed7c9df69dd38b4a8992be33518b993948e1d0959d7fbd0ee0d842be50ae71438a11a8f4381","ssdeep":"","tlshash":"1941900dc909adb498c9d59971d5d70165887f37f1b88da8e04bdca4038b03d0beab87","first_seen":"2026-01-31T21:17:17.89987Z","last_seen":"2026-02-01T19:03:24.064518Z","times_seen":2,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/providers?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /providers?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a58bc1a4cf52319a-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4%2BOO3oaIn%2B%2Fc%2FsR%2BSh%2FmIV28MNvjB1%2BjjwvwW0byqGa4r%2FJeZuHbYVxeJU0b%2FD2B6sa3jyAcB20A8VQexgHr2itMzrJUaZ5s%2FfVHs8h%2BgJ2aY9PFFvCoNe4%3D\"}]}\r\ncf-ray: 9c73b4a0ed865ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":90,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/4b5fc2a2cf150c41.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/4b5fc2a2cf150c41.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"734d-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W7j2N8xPsseaawHNULkUz1jYEVVK0a5PVkkD58IHPMyAyfEzO%2BRDhZHmrsDrsbd5lgUN4U98AISY69WAKYwjY96frdSOjzoearNhT0O50MbzO4iJrJ3bPyY%3D\"}]}\r\ncf-ray: 9c73b4a20dba5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29517,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (29160)","md5":"9a2db0f51ceee4b64dcf2f34b7cc5de1","sha1":"9d13515ac8e3613937c7e41e704ff52760ddf473","sha256":"3e316fdf81283e8d0d6e95f67225560ef3c1c3b33230192de20cd9a9516a75f0","sha512":"80ac75dc3f6084d84660a5bc6fed6ae94440a6018061ed1fd18289c226952ec56b4790a8d42dc197cb5277edb1596fe26baeea78de76d04cb07d3f621a6657ee","ssdeep":"768:PfCxyEdRqNnKG1+g3fA1SjjDrxEBK8mO2V:3GyEdR2KG1FP","tlshash":"78d2b66050457abcf56708a8ba6dc40cb11eae6cc70fcf18b57c7c253c5a9816d96f93","first_seen":"2026-01-31T21:08:57.196019Z","last_seen":"2026-02-19T17:02:28.856281Z","times_seen":71,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/ph/e/?ip=0\u0026_=1769972569539\u0026ver=1.318.1\u0026compression=gzip-js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /ph/e/?ip=0\u0026_=1769972569539\u0026ver=1.318.1\u0026compression=gzip-js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncontent-type: text/plain\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-8f80dae6c809c017-0\r\nContent-Length: 872\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FNiW6ibow6ejVgfl7rnWiY%2F8rEYfGRYR4LqhHnvm1Tc%2FmvNeHpphwlREETWeYeS7pMEJ4qdzcsEPLEBkdMN2hpQkJrjFta8nJzLXgLXdWIH%2FOXYzokyMfqg%3D\"}]}\r\naccept: */*\r\naccept-language: en-US,en;q=0.5\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\ncache-control: no-cache\r\ncdn-loop: cloudflare; loops=1\r\ncf-connecting-ip: 91.90.42.154\r\ncf-ipcountry: NO\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-visitor: {\"scheme\":\"https\"}\r\ncookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\ndnt: 1\r\ncf-cache-status: DYNAMIC\r\norigin: https://postfinance-user-auth.com\r\npragma: no-cache\r\npriority: u=4,i=?0\r\nreferer: https://postfinance-user-auth.com/\r\nsec-fetch-dest: empty\r\nsec-fetch-mode: cors\r\nsec-fetch-site: same-origin\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-8f80dae6c809c017-0\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nx-forwarded-for: 91.90.42.154, 172.64.209.49\r\nx-forwarded-host: postfinance-user-auth.com\r\nx-forwarded-port: 3000\r\ncontent-encoding: br\r\nx-middleware-rewrite: https://eu.i.posthog.com/e/?ip=0\u0026_=1769972569539\u0026ver=1.318.1\u0026compression=gzip-js\r\nvary: origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://postfinance-user-auth.com\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 34\r\ncf-ray: 9c73b48faa315ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-08-07T13:15:32.647925Z","times_seen":43661,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=13nbf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=13nbf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-8dc6f5f737d1f416-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=13nbf\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F2pBw0aRQWKX1e7IZw2fsSnIYKkbGOiSFn4K46j03KNval08ahTEtm6EdbB2yJORhcm1qKSebd1BC0HjQMq2HlUTWGH55GWGuJggSOqk6tm6CBH%2FQiaB7XY%3D\"}]}\r\ncf-ray: 9c73b495db695ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3448,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (2946)","md5":"83a291f0cd9e53800d3716e4a2666427","sha1":"b55c49cf134f24d61584f24713a4c174360bcc0a","sha256":"98413554772af70f7cecfce5f5c90125b5cf1cc27f61776681c4596ccccdb267","sha512":"76bfde39f701c4a64db51b649a0dcceed5634ff8120cd5f8a13bab91fc009dbeec34c4225588b35872d6f9e880dfcdc63861a94803773fda24b0c25acd0aa5a3","ssdeep":"","tlshash":"c661327e120aff6c6a2b054c545ec32a635d8a36f7768e76e2fd8d72034a0245b872c0","first_seen":"2026-01-31T21:08:57.201017Z","last_seen":"2026-02-01T19:38:23.405245Z","times_seen":36,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/platinum3.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/platinum3.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5966\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:42 GMT\r\netag: W/\"174e-1930f245e70\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qORC9U9KBWJT%2FVfR03hcys1%2FbCI3ohEjt51TwVkuyYRZTxhs1HiUS2SBOc9yFIXgy9ce7mFeSz9ZsRsTqI3Op%2BvFZAKitDJxzF0TUp0ZO0oHSIr2C0vZmPg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b6c7f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5966,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b2c86c0f03f99176fbecc9cd4385957d","sha1":"3cad9a6ad60de77081e4262fab65116dd5e2eb6b","sha256":"40398e35501f3d1fe1bb67d3f041554af47cee1992e09348684366c2ac77afed","sha512":"3dba5a749ed27cf3e306d827ff1aeaef44b5a8a9fdda8c64f8b4e2908897d2ebdce614f7c6fd5ab671b21af5e00bc3287e9496828298d3bca351d4ba728a3b46","ssdeep":"96:d0RqdQalOrDJ/aw7j1+j+IUIyKM3aRf5NVy8me+AsOHcKFkdzIiVw1wAS1s6Dsdu:dsqB4N+EIy/a1vCJAsO5F6zGyAksosL+","tlshash":"22c17d3575dcc85d6844cc76b182cffa15767280b5a7302dc5e0ba398d2498b639d4e3","first_seen":"2026-01-11T02:03:05.524332Z","last_seen":"2026-02-19T17:02:28.716307Z","times_seen":36,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?action=register","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?action=register HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-815b456e962ce545-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?action=register\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MK511z4ntxlMlff9dV%2FsmucnnMVY90Zjksrf4Hebd4ZRUl3XEqVHD6yaGPAQG5sQdaViDxNhBI9C%2BA3XLqMNeD2sbzd4TCzq%2F1R7DPS%2BUONozPTwenc9FZI%3D\"}]}\r\ncf-ray: 9c73b49b9c945ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2345,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (836)","md5":"2629d011e4832eb665d489bb192d844b","sha1":"8b2f717455b65a79a67ea9850eb981460d9f1b1a","sha256":"710aa66ba1747d8d0b9eb67008106c47ada9f6be8e7b091b48cf8975080ec629","sha512":"306ce5376dfa37f17c4dd3764f33471d3f5e7c30d78b3ab2a01f1ed7c9df69dd38b4a8992be33518b993948e1d0959d7fbd0ee0d842be50ae71438a11a8f4381","ssdeep":"","tlshash":"1941900dc909adb498c9d59971d5d70165887f37f1b88da8e04bdca4038b03d0beab87","first_seen":"2026-01-31T21:17:17.89987Z","last_seen":"2026-02-01T19:03:24.064518Z","times_seen":2,"resource_available":false,"data":null}},"time_used":571,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":570,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/terms?_rsc=vw9ze","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /terms?_rsc=vw9ze HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/terms\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b2451f95879f6ba3-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms?_rsc=vw9ze\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TlpyEP8gh1YJ05eiUr9HkBbGYPg7HI0EOl%2F%2FfJN%2F0yRQURde%2BfORgefApJ9dcdU4Abn4Xr52GV2ZjpbffPmRtk%2F8G%2Bez%2FItLX1e06bO%2BNfxnkNnzfGgkufo%3D\"}]}\r\ncf-ray: 9c73b49f3d305ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/providers?_rsc=1yfka","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /providers?_rsc=1yfka HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/providers\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-bc29878b6adb7e7b-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers?_rsc=1yfka\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6YeiTYUdBqG%2B7W%2FMreHo1exS1cPF5%2FwRtHRu2Xjk0JkTlhmNiHSepEzzQkIrOp7Y28w1WaKqeckSvk9x9RSxEiVYhmdD1PvNGtFD8hYk3JedhLkv7%2B%2FBMcs%3D\"}]}\r\ncf-ray: 9c73b4a16d965ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":520,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text","md5":"857a2864c3686f888291165016bd2018","sha1":"beb130245c6d9ce627714ca17ba3c25bb50a3077","sha256":"6c6f663b1a957ac786ac52eafb1c48d30aaf4bce253dc6fdea165826a56e7edb","sha512":"390753f8ed92fc876451b2311990d40d39dc8f9eee5a7d3985f5a29857ad00c2c827e4457bc0e7bd29a8403a95453b95e2330afca600957ed3e098dd8d71b8cc","ssdeep":"","tlshash":"37f027b3d50efd252d2dcc4c0e5e6323859c58779ab51af4a2dccd9c47d113a4b8a1c0","first_seen":"2026-01-31T21:08:57.193561Z","last_seen":"2026-02-01T19:38:23.401871Z","times_seen":36,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/group/slots?_rsc=e45lv","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /group/slots?_rsc=e45lv HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/group/$d$group/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-acd514cda284e7fd-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots?_rsc=e45lv\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EJEMzE%2BKgUXAlMKScVAx3J5EJdjHL6ZzGRrJn03r3b6cYaXt1wekePw3Ft0O2fJsgmORiJJqNjWiFHm9PzQBtSKSSACfJ7rkn3jCNC5y1yltyGjkuOaVOwk%3D\"}]}\r\ncf-ray: 9c73b4a20dbb5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2179,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1623)","md5":"c8ed3d697dd31fcdd1fbebabf74e0415","sha1":"3d09fe2606ba32a1a556e1566c2421da250f7f74","sha256":"9130482aa3c1cd58e47db08e5af2bb755f50554c5077e11368d13b565f811a88","sha512":"c186be602d15d80db5cec3f8db92d8d126b8af2b480c05d913be58e3c6bd7d7a27a61d0c8a03a593758a51b2c9002172c6e17d475f5455a16fa7f5c236970a31","ssdeep":"","tlshash":"8b4170abd80efc551c34cc5c2d6f6376958ac8338c344cacea9edcac05591235b990e0","first_seen":"2026-01-31T21:08:57.307525Z","last_seen":"2026-02-01T19:38:23.422471Z","times_seen":33,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/a85c5f2112ae0905.css","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/a85c5f2112ae0905.css HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"ce7-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SopJO7v777h1wEOB2RiEybS4YbOo3eDagyC1HchmyNbt3sOIKExyW7EFjxML0yoKypoSm6sNgJvGY5AwPvFBjlWMQQ0YlDiII%2FyiLvBMphW2o3InfYMT54g%3D\"}]}\r\ncf-ray: 9c73b4835f5e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3303,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (1085)","md5":"e0eae693638a4faffd4c9f557a7438b1","sha1":"6bfb8474afb2f4ba719f35fe3dc2aef001107552","sha256":"5d3675b31c9a19c7c528d457f5543f31e62ec5d85f076f8de0ca5ecc8bb47367","sha512":"3843c89db03ab7a8f9e518bd9e9590c414ecfcdf24e6eb6ae8ef9da51dbf37c9bebc3c1e08072f7cf75ed6b5610766e024574425042890a0d93396e2ba46ddfa","ssdeep":"","tlshash":"e8617510011e923ad8b59d97778e3fa13ca8bc90a5795d23e5290d2d8ad7c7b13f0f29","first_seen":"2025-11-23T22:59:50.498332Z","last_seen":"2026-07-30T14:11:56.975941Z","times_seen":221,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/6ad96a8ea39e5f61.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/6ad96a8ea39e5f61.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"8013-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mE01Dw67WysfJ1lscqQ986SJgOBKOwbJ%2F%2BNJGp7q%2FC04N7cgF1tT%2BK78iFM%2FQiwvJSrR%2FiJ0o9UsLd0bH4b%2BhRGsoGwxESCKA6c4Zq%2BrQxIxvE6fmy%2B4FvU%3D\"}]}\r\ncf-ray: 9c73b483afa75ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32787,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32430)","md5":"58590522cdb7953a32a5e0ffbcc8cd6d","sha1":"ff06e9fc51e2f9be9ae55c9cc2bb9e6901283967","sha256":"bbd0a5562d046864a232012dda15a366777f9b6677b07ac7b208804f74e0324b","sha512":"4e59fefa47581048a046ce15f05cd9820f7818d5cfd0b2fabb7544ce6908ef662091769794ad31eefa189e042f99fec03a86f31eccb8e8a50e40e9f4135efaa9","ssdeep":"768:GKuzc3PXS6w5ZLpJz9tEK+nmKaSIrstfh+kG:9cc3PXSLZLp9x","tlshash":"dee2c66050557abcf56704e8b66ec40cb11e6e68cb0fcf18b5bc7c2a385a8816d96fd3","first_seen":"2026-01-31T21:08:57.328326Z","last_seen":"2026-02-19T17:02:28.658552Z","times_seen":71,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/blog?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.795Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /blog?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-ad043a9fb180b70d-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zjdt%2F6AeN%2FmNtsIiQJ85%2BIsizRFtEJos7gAmRH7J%2BtQp7YL59jp7NsNmnKpHJz6s0rrBfi%2Bx%2FcV2Mfsn%2BJjXMkiXvP%2BmPZo9XYaiDVBJ2wvLTo9ismcgf2U%3D\"}]}\r\ncf-ray: 9c73b4912a5e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2465,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (956)","md5":"198b8bbb1a216b01552a24904c65b34c","sha1":"c933b333d4956d784d52b929b5002d44c121704d","sha256":"fe19bcfd1f670daf04c4b5a3cda0751615c84cf7d9b75880f75785f9a8d20ff8","sha512":"4f90d41e4711ab0f68940fdfc59fb38eeb2a987653e4c5616f3ff4139cf900fd5d2425b91546b603b30022b882c4d91b139527e58cfc2a419a71729f9cf917e1","ssdeep":"","tlshash":"5e51ae0dc809adb498c9d59d61d5d7016998af37f1b88da8e04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.895038Z","last_seen":"2026-02-01T19:03:24.197949Z","times_seen":2,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-ultra-hold-and-spin.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-ultra-hold-and-spin.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 38884\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:06 GMT\r\netag: W/\"97e4-19baced8570\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8xttCZVxN62jtCrjbQhOJ%2Bi7wZCECOMmuN4jctW%2FamufzamkzrL6Ro%2FEAp6awgPk%2BJl6hPvFIoG0jMFZ3Sqhx%2B5IMoQNHni1hIcFJ85WGwu4n8iVUMmYg3w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4982bfb5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38884,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"746599cc014fac1e5ee3cbecf32028de","sha1":"285694c3b94f0a1983ee2b88928e3308ecce8c4e","sha256":"c410bfead0f4175eb67c6292afa41b824aa041b116a51e114fcbe4dc9478b590","sha512":"a86e6d9a692df41fdced11409e01f8c3505d61b8e75b114c3ec95e679faca084e23086b5a00279761c86c63fb4bf81e7bb29f6e991d3117e8a4a03580d449de8","ssdeep":"768:BMslVgiAJaWD1uX8CRyKr2gxyWhFPK/jyf+hJaNv1hebdigKlxKu1xL:BJzBAaLXZR7rhZK/+Gh0NkdUX","tlshash":"7203e1897c57a3b6d8b3a209c035e2c15122515cbe36cf3c980e63d11c7aead1234b53","first_seen":"2026-01-31T21:14:50.721148Z","last_seen":"2026-02-13T20:55:00.835045Z","times_seen":36,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/platinum2.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:59.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/platinum2.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6378\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:17:40 GMT\r\netag: W/\"18ea-1930f2456a0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7IDTJkoUJQOnoM8d2YJYLAg2O9jVfZVQphKe4uF7c8pZZsXwVlzmd2S0fM%2BOewHjXToZfoBC84vDz1ipGXKsEexaEDwLo2qcyS8zsE4ym%2BddtjAq0d%2BdsOo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4cd8d7a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6378,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4a423f6be8f0fecf632a0f5d0b7d9c02","sha1":"467f574178cf7fcee18c4c6a7929e0a11cef1f0f","sha256":"66b2d04dfa37598e4198f58f697e2c22a001f5855036be548b033469ba34065c","sha512":"e3433d8eadac1e5e87ef2ce2da4920e5836ab04ddee60126714b3dbec42c3dbc7bc2969a39d004fc2cca26d7c7d7adbcd8ade2a9dad7af03dbf24775280fdc0d","ssdeep":"192:PS7I+JuOAeimepdWkN4AgW2KYNQgbC3wFeqUqU:PIIuzAvrdWdAgW76Q+CgFeCU","tlshash":"c4d190114199f84a0569089398bad3dac34000dfb37a52db1392d372ee69d7c2d6c7c7","first_seen":"2026-01-11T01:55:53.573014Z","last_seen":"2026-02-19T17:02:28.751592Z","times_seen":44,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/2/envelope/?sentry_version=7\u0026sentry_key=6d319d1014d598ea4a0365923853ee67\u0026sentry_client=sentry.javascript.nextjs%2F10.30.0","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /api/2/envelope/?sentry_version=7\u0026sentry_key=6d319d1014d598ea4a0365923853ee67\u0026sentry_client=sentry.javascript.nextjs%2F10.30.0 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 454\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":454,"data":"{\"sent_at\":\"2026-02-01T19:02:49.128Z\",\"sdk\":{\"name\":\"sentry.javascript.nextjs\",\"version\":\"10.30.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"a33a65c0c6f243489a0288fb812bbd43\",\"init\":true,\"started\":\"2026-02-01T19:02:49.127Z\",\"timestamp\":\"2026-02-01T19:02:49.127Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"web@2.9.0\",\"environment\":\"production\",\"ip_address\":\"{{auto}}\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y07S1HVGUeSkcNdiaHaiWLSJwNpIRvGOVFpSM2lM1VhwAS5ewf05R4sk4d2TvctJ6cFS%2F1h7KVd7Mvz6Es121iyH5JAmsBT7Ee62dm6o9x01wOMw8iuVG3k%3D\"}]}\r\npriority: u=4,i=?0\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b48d19bf5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-07T14:08:39.057579Z","times_seen":756484,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvgaadl\u0026sid=F5kFgPvxx8BidtubAA3h","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvgaadl\u0026sid=F5kFgPvxx8BidtubAA3h HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b905f529a6d0757c-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z8KkJ5IcBENWqvSPwAyXCOTvw0FQmni3l1gLtq9pfSk8SNyfmF9zXROx1J0%2FnI1u2O4wJDwyFxxrO2GeXR5W%2FgVKAcOFep%2B%2FgEYnCZ6GFxWxXyIHPSnpZno%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: no-store\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4915a675ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"b56416aaca6b4d34e9dd3391d88f380f","sha1":"ac357d70ea5614d9da91f79c61d1ee240488fa91","sha256":"d07fc80dabe38fbfc8837fff1ac2ec6798de113ff785fdcd865db781ea7daf55","sha512":"a774a747fe515f1263a8f11ae33ad37761a31afa314fc297e37f777306b296fccc61e1be97f2038256d53cce2daf3aa08d58a63ae124488823b2c8a19ff5a4fc","ssdeep":"","tlshash":"ff80000022f830baa0e32883e03388000823a0cce088aa0820a8208aa2a3000ec823e0","first_seen":"2026-02-01T19:03:24.201498Z","last_seen":"2026-02-01T19:03:24.201498Z","times_seen":1,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvmf3uf\u0026sid=F5kFgPvxx8BidtubAA3h","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.011Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /api/socket.io/?EIO=4\u0026transport=polling\u0026t=3yvmf3uf\u0026sid=F5kFgPvxx8BidtubAA3h HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: undefined\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a8d3c7c8774dedb2-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uX2MI6oHmPtGGPWaLU%2FDoofwRsRgdU7ZZDd4cFmtw44j7%2B%2F4iJYNhFBScILvtG4JWd0bf9vU4hCLHzKJJhXEacMWRAWMpcJOpxSkKLvf1GwTswC73PeFyhU%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: no-store\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c73b4929aa95ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"very short file (no magic)","md5":"1679091c5a880faf6fb5e6087eb1b2dc","sha1":"c1dfd96eea8cc2b62785275bca38ac261256e278","sha256":"e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683","sha512":"3c9ad55147a7144f6067327c3b82ea70e7c5426add9ceea4d07dc2902239bf9e049b88625eb65d014a7718f79354608cab0921782c643f0208983fffa3582e40","ssdeep":"","tlshash":"c700000000030000c00000300000000000000000000c00000000000000000000000000","first_seen":"2023-03-07T01:10:09Z","last_seen":"2026-08-07T05:32:23.715271Z","times_seen":12049,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T19:02:47.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-stale-time: 300\r\nx-powered-by: Next.js\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E4jxfF26nI1b5hvDiou%2BPqk2kcaXeSDODS35%2BtO6zQYf4EPfITI%2BfFHL77ngnj%2FHEnjronWZ%2B%2FZ2BzpJ0dPKkxyTBgzs9MADkvXDnKu04P%2B69M0t9gcx\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c73b4800ee67129-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}],"data":{"size":187763,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (41805)","md5":"5e91dd28c3e8c3b56d06fdc1f1bd5c24","sha1":"f3a68f8f30ddbdc21d1065d0c5e37e1d787f620c","sha256":"f098af1b87dbc30088d983a5824a459e43ee952a458e5676ca27030bdae0b885","sha512":"9ad3894e996b60567a9deb929e5a66ce2e9f540302df79552f2bc99be532c95e5f20853f28bd8c03b985645f3adeb069d19f4456f8bc3cf34669d11d1d6e2900","ssdeep":"1536:B26gZmxj+iv1X7AVPYSsk10aXs76M/2yT+VvzrAGJU4B/i2f38pMZcUZnFn:o6geiiD6M/2yT+VvzrhJUo/i2/8GtNJ","tlshash":"5004716ee80ae958ec66ed9e113f5f3a94c9c8778631c92ce3ddcd58015243a4be9dc0","first_seen":"2026-02-01T19:03:24.203431Z","last_seen":"2026-02-01T19:03:24.203431Z","times_seen":1,"resource_available":false,"data":null}},"time_used":392,"timings":{"blocked":26,"dns":10,"connect":1,"send":0,"wait":336,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/1b665a0afce73dad.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/1b665a0afce73dad.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"e473-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7gEJTs8SAsG5M5zx6v%2BodxeXjRcGaUugMcwmRpaErk3EVNFVgGolt1yGFTpJ3EDrgVfKL84Jm0AObdVgBFtoDIcX0H7Vqm9EANjwPrlb4MpwyKtBpTa8hiM%3D\"}]}\r\ncf-ray: 9c73b4835f6d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58483,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32244)","md5":"c2e0d2938c329e8e4e3bb947c411965e","sha1":"eb9ab849c9e0f4a8dbd455cecc450bbee2988bf1","sha256":"fa375e72bdd6a25673f1deb2341903ddb31dde73ac45085ff8146e1a750e7150","sha512":"5af91b03962f20bc171e220cc361e202255e5eaf4777430d72f2dc8780f4da664b1df6d7e8d2c8363720491dfd1b81a022437d4a1359c5f91d76b5d090e60be1","ssdeep":"1536:M7JIDwUDps7xdBmFLkjBnx01mId5iYthtVo:GIbDpsBCLkRx","tlshash":"4243d8d97392743117aa1225907e4107f7b999d0114b8028fa6dcdde3aa449ab2f3f3e","first_seen":"2026-01-31T21:08:57.240408Z","last_seen":"2026-04-28T01:10:54.143261Z","times_seen":182,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/d46c8391d5bdfe55.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/d46c8391d5bdfe55.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"77ec-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qkpklT063hgwrVu%2Bc%2FdCfP%2FskUPjLDEGTZmmq%2BN7MVl9yRPGQpZxZPTwNRLa%2FV2f1yGjxXgxCqpDLkVuZkVfnLsfHyNMOdM9knHZKG7JYJ56bQ1ftdtOcPk%3D\"}]}\r\ncf-ray: 9c73b4836f725ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30700,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (30341)","md5":"faa78fe4fb496d7d7e8e0291756cc1f3","sha1":"6bcdf2e14f91b5fee8d295edb9851320adfa4a5b","sha256":"ed4ffbc69e75f48ff9d13860973a024f747da39bfc52be9986bf425f80ee53be","sha512":"71425d412f0ab946f12fad31d78cc15dc986bebb3087ef3c8c99a5c4b63dfeb2518c28c878c89596f5f384ec5c4a094c97a3d5214610651a882d45a4d9f1c3a3","ssdeep":"384:Df58F5SF5BqXE0msKkymRd0cJ3ED79Fg/aW8qWtOPSNAatwMs:DB25SHBd0PwMIxCatwMs","tlshash":"9dd2c8b17395f9b352db86d9d03a0015f2290d3530ae28b0b394dcef368dd8991b9fa5","first_seen":"2025-12-31T07:43:06.411892Z","last_seen":"2026-04-28T01:10:54.127528Z","times_seen":185,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-jokers-jewels.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-jokers-jewels.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 39740\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:58 GMT\r\netag: W/\"9b3c-19baced6630\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gBLQ%2FMNC5lyoh6eXxWu0c9hj6BH5n4yOER%2FmX9UTJGhZoBLwCBt9eW1mfF0sBsbXNjyLcpYksxOItGNVgMsrn9XK91iNppAFxCjcYyg%2FkDC0JGGrSjGKHvA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c3c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39740,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fa8221d47a06918953027c03798dd4c5","sha1":"f03981956da1966888442cd82caa655416fcbd4c","sha256":"a0ca12be48301704dd2533f19a42b0c022a1c6b5011d5d2ca9082b0a79d2c36e","sha512":"43f6b8de00df387dcc91d197e82d7b144c856ec4b8bed6eb01f5dd84593682432d44065c1104249cab48c61d932ebd65319b2068a008b80444f8e837ca2e663c","ssdeep":"768:a0oIikBnCcYdYdLEkmz8SXWaG4UZPJ9dGNRaRbyUVd7tbS6PyEbKo:av6HYYRpxtPZPDdkRXWd7ZS6qcP","tlshash":"8903f1b3b3d2c01714be855f9843b63500f6cb94a5d4eb4ce2e6f16a60779db0837a26","first_seen":"2026-01-31T21:14:50.620987Z","last_seen":"2026-02-13T20:55:00.755374Z","times_seen":36,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/providers?_rsc=s0iba","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /providers?_rsc=s0iba HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/providers/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b40cb303544a4ce0-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/providers?_rsc=s0iba\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sXnssAljjMjjqp3pMjz%2FYLEDsoJV7OgEDQnQycvqmItoXN%2F4XYWPU%2BttaqTEtSO4DBXxZz4Dxo8owTqAGRZgkSQHA4Qgoz9qRxXkxBeBntN1bS1tiOltuSw%3D\"}]}\r\ncf-ray: 9c73b4a16d975ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5005,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1670)","md5":"8959abcb9d9f97f5681d545dfca8c80c","sha1":"5c337d890bd8117d30161bb2890afd42f285deea","sha256":"75d9bb6e282d04aaefe525ce72e4fdbfeef59161be91a9f4b1f71642d56bf16b","sha512":"3d5724bb4993cf848f6a463b63fbdbc3fd7e8e2ec9bee0e2cbfd74a74bf772af5f01992d786664cf0211c4f0d0449d0d4da446648591e53b72650bd00855d6f2","ssdeep":"96:3rnkJZVqqegCrnkJZVqqeo3eRKRemkvVKZ/L5QXqIvTM6p:bnkJZV9JqnkJZV9BeKRex9ssTM6p","tlshash":"84a1cf6bd90eed985c26cc0c2c1f5377928ac873dd344da8ebaeddac05490125f8a1d0","first_seen":"2026-01-31T21:08:57.367485Z","last_seen":"2026-02-01T19:38:23.492933Z","times_seen":33,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":92,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/about-us?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /about-us?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-933c4a5474683874-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/about-us?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Twh1hns9RJWKdH70knfScE8MtHd1q%2FbGTlfaCp%2Fpz0FOs8KKU%2B6edFVIcnBbjfiOWX9%2Bn99Vt92GFnQk48lRjra63yjR3oAc1jlE7elk3Eal%2FU9vpmlTJyU%3D\"}]}\r\ncf-ray: 9c73b492bab25ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2473,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (964)","md5":"1be4d9d3c8951f2b1c077c5aaa5a9b4e","sha1":"bf4cb22cf4d550ca6a4879c7ce9e4ebaf2b3d6fa","sha256":"8922d7aaffa3bf471d5af3c16b2b23fb19a2d106c006286d30235e8d4e393276","sha512":"82484c4a01a8a1884fd9509f8bc1f0d67582cd11701a8bf8d55530310caeb192a57f4d87caf5e07f2d67865bf98dcb32cc56626d6ac339acb34c7c5b859c80f8","ssdeep":"","tlshash":"f951bf0dc849adb498c9d59971d5d7016988bf37f1b88da8e04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.866014Z","last_seen":"2026-02-01T19:03:24.208388Z","times_seen":2,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/DMSans_Regular-s.p.e7e0f28b.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/DMSans_Regular-s.p.e7e0f28b.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"dc20-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0c6ITtSK%2BkNV2oDd47otjAzbqHkPcmNAFL%2BsRoIXhlSxjNyKfHXT6U1ApvjQKpWawPmgRLICKjR0cxAZSJpf8CqkcuIS4ku7XU1cqfWYdXYzMlTdx5lxUcQ%3D\"}]}\r\ncf-ray: 9c73b4834f515ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56352,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 16 tables, 1st \"GDEF\", 42 names, Microsoft, language 0x409","md5":"0305ad7453af42d8f036dd29294ae5c3","sha1":"ac9a042a40e49e8cdbfe0e64e84d9b1c5724e98d","sha256":"7a73e6aa8107e0046eae5dd713bf4752d93e689f57d51c45b1545acddfd71be3","sha512":"d5a1bc2041edc0debccd45637460ac89ac3234859029b8507072d6232bf0f0e9229864ce51ea3b43eacfdbb029228242bfdca046ef86db05a1ab278ddeca209b","ssdeep":"768:VJRyPX2U7ifzsuaBqydjkUP057fhrrXtk1ay8zENP4EgzwtCE:DRyf57eQFdjkS0HC1aSAbwtR","tlshash":"60434b16f716871ee2936eb9c673d3a4e7b5bd30be23434b64755b2ade0b0e44c21284","first_seen":"2023-11-01T17:45:54Z","last_seen":"2026-08-07T07:34:14.087882Z","times_seen":878,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/7699dd9768b273c7.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/7699dd9768b273c7.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"8137e-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=24jvFT%2F37QJukB3NYQNIqeXl7cCUof%2BLeHHB2%2FGfdcXU%2FyLZw6FCd7dpztq4xquIHDxrqv4Whln8jFD1vComF8JcOqPaYIqlM6EVdr38Lnaxg2%2F9R5ri7b0%3D\"}]}\r\ncf-ray: 9c73b4835f6c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":529278,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55790)","md5":"5dbd085ce6a6c185ebb193a0f6eecf9d","sha1":"73b8784d3a8c8320e3b2f06e0be20c96e8a7008a","sha256":"33022dc63e01d695407e491ba7831429b9d207742b86938a2ab14dee4720ba40","sha512":"a073e598ebea89dc13853921dac5ef3fd74c1de418739f4897067307614ed807a0e9349c365933698f45ada338197b841f55e255854e2be2c2404d9e4908fe25","ssdeep":"6144:Da4781+VuYZlk8X4QAZt7dIURZyHnE3Qer/Ut18OZzljzC4l:9PHAZBdIURZyk5iZzzl","tlshash":"16b44af93695b1735ba602a6407f1002b338196b240e4864f365edde74b884aa1f7f7e","first_seen":"2026-01-31T21:08:57.204993Z","last_seen":"2026-02-01T19:38:23.454705Z","times_seen":40,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/33f100802e817e42.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/33f100802e817e42.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"21e6d-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sMcNooDdzos63EvK%2BHwBULOs98t%2BF%2BcnWcufQqOqdQ7FMeTiSRqQ2r2ZaBWmkdndOGc0DqdlKHWMWRM5IEYTqpdyWD%2F5ZqNLtgtzueO4qb6qis6Jok9kTUI%3D\"}]}\r\ncf-ray: 9c73b4839f9f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":138861,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (62859)","md5":"debbeb6cdb7b1be6de8c93e038673ebc","sha1":"1f4885dc43cae313308c1cb103cc4c5f5cc1097c","sha256":"df401cb98f64505017cb9cc89ee34782afc0db5febb7f4102c2be08286280b3d","sha512":"5e25627b862997c1bbd192e9c1716099bb6486aa555eac7d5e37c756e2473825a8a670cfb751b9c5a5542b01b98eb6bbd3b9ba9ef9c4bcf786cec5267bc60832","ssdeep":"1536:UAnRBc9eym0bpa/Bh9QpfBuhCVKewjFSqE4eRlUxwugwoL5CLOrObU5W/Ndh9w2y:nnzc9eym0NN4CK7FEObU5W/N6yDQXD","tlshash":"e6d33ca53300b83599ef83ffe05645a9f72c2709c1099024f97e5dee232caa57157b3a","first_seen":"2026-01-31T21:08:57.287659Z","last_seen":"2026-02-02T22:33:10.157366Z","times_seen":67,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/op1.js?v=1.1.3","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /op1.js?v=1.1.3 HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Tue, 13 Jan 2026 19:35:43 GMT\r\netag: W/\"1712-19bb8db5f00\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VWMlG%2F9DCpov6ZE6YNrpiVb%2BQY%2BnqJdTncorf%2B6DSXAyUzORXi1K7NkP7ikUBbluHDU6OW39tvFF%2BPCOwqTFAcN6HkYpC5X8JYh2RWmtx%2F%2BQec7b9qJVoJY%3D\"}]}\r\ncf-ray: 9c73b483bfab5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5906,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5905)","md5":"8bcfe273763be53ba87613b21d4bd80b","sha1":"0784b9ce9f450c2bb33a9b08a5f2de2633e0a481","sha256":"d79474635d2a5fddfea4f74fbcd168be27fa6a40545ef2d801cf146121cd41c1","sha512":"f5de8b0a6c09c0502c0d247d566d69ee8deb3e67b463d7a31de7a5e0adcebd353ea513f084a6eb4504f602999bba6806015b75930f464a7aa6b7d7ba0290961e","ssdeep":"96:aTF5H5HQTNy2o4j471V0HjDkAMEmLmwwrHGNsuNS3DWmoLxu:e5Z52DjM1VYjwAMlkrmNseS3gu","tlshash":"7bc196e332ea25f246ee74a9d6213252a73817b4340e501cb76caddb1484d06b3e5fb4","first_seen":"2025-12-19T01:02:07.6499Z","last_seen":"2026-08-05T22:14:11.448888Z","times_seen":274,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-triple-pot-gold.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-triple-pot-gold.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 72680\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:43 GMT\r\netag: W/\"11be8-19baced2b98\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UH9RDlSKi4yb0ciL2SSC6%2F7ZfV8XfHVUrbTvYIsHpXKW4naqq8RNUYG3AtLawQsdG0HuddoKT0UFHsLG%2BJ3Z8LGFY3bBimI9qkyNlpW9VKJlRmqdO8u3M5Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4982bfe5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72680,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c95d876096556df9e7631e45ebeea811","sha1":"27387071917715223fdbf76339781edc8c327c56","sha256":"9a4de042a23703ffcb5b882ce63e47ec6a87e9da712cfcf2925b9c58537e2029","sha512":"6d84d22cb9c73ee9ae2ba2deaba5a4b2c44a3212914c1722c840cc726bb570589c0ca2198f561eded4682ae8ee33c484a6284361128bc4f314c482ea39b2610b","ssdeep":"1536:+X/mcutlkDu9XmkhNSubgfC7A0fxx69im0PjsSfy4n:+X/6lkDu/guUcp5x6kjs2","tlshash":"ca63026cea3471bedd4de2adf9ec1b9c1dc7343f2ca45a967172721a46c6409b1f8014","first_seen":"2026-01-31T21:14:50.623971Z","last_seen":"2026-02-13T20:55:00.747557Z","times_seen":35,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":294,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-cash-surge.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-cash-surge.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37510\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:42 GMT\r\netag: W/\"9286-19baced27b0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oD9mDfYwLJre5%2FkMQh%2F2g43iuxIqdExNOzBhewViJ5iOBttzDL1%2FUizDfYZAK3L58Y5SobUvkHquvQ0pOvvzSYlIUE1rfmiFcfwZBWkRGIcpanRzV%2FJBlAA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c3b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37510,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ac4c53d36a34f1c9110ac8e03501904e","sha1":"0f8a5a80b599957a19f3987efe014ed0b075efe9","sha256":"0f850711681b835051109192f9c5c0a968f41e9aa35c5a1f80fcba6981bdb25e","sha512":"9c0e78877e6535ce36426aac2c7aec5728bb15c84458b8ce936d5c57b46159ccd1428d2823e2c6fb5d5b01e5d6f49acba5f249b90311584bff85bc7f871c7a8c","ssdeep":"768:q6kHIwR7tKbw3lel/TioZGaIJooxbtuIlevsT/wSTwaSuRnWMYe:qSw1lM/TlG7ooxXlSCCaSuRWG","tlshash":"03f2f15866507a357b2b0e8effb8a4e4cf19fd90f62c4a82605b0f26dd27f463224354","first_seen":"2026-01-31T21:14:50.631089Z","last_seen":"2026-02-13T20:55:00.803361Z","times_seen":35,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/blog?_rsc=1kw3o","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:52.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /blog?_rsc=1kw3o HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M/second-design/!KGhvbWUp/blog/__PAGE__\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9b52766b24ce9654-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/blog?_rsc=1kw3o\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OB3KbH8Za8gAIIpHeSxd64tbBA9ETWZxxnaiY6cCn%2F01TorSg%2B07T7DcbrKQSsXyA32oNvSwQnpWW0gLUqOnyymoCcMOjGY0bnoZ30pK1e5poGEo7h7Alz4%3D\"}]}\r\ncf-ray: 9c73b49fdd4d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":221168,"size_decoded":0,"mime_type":"text/x-component","magic":"Unicode text, UTF-8 text, with very long lines (1621)","md5":"12a19956802aac7a96bb3003c8ecb133","sha1":"7773cef09d7848da31aa2dc22dc2eb12a36d8c92","sha256":"b03625e5307365618dcf528cab913d93a61373c8ba70da91607eb0405a8177e5","sha512":"a170e0a0a08bc2f0040bb968dc21cff7a2d70948555edcca8baf68f5507d8dca3fc30bcf731460a0c54eb648d17663b5c59d472f2cc34166528fb95d7e9505aa","ssdeep":"3072:YyI2liLaJ0X346Tmcxy21qx8+ba1wcFpfv:3Ja346BMa97","tlshash":"852419167b1c31b007f305ab367a32ddd63a9014632665ade9aec06c236a33d8736e5d","first_seen":"2026-01-31T21:17:17.951606Z","last_seen":"2026-02-01T19:03:24.213807Z","times_seen":2,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_Medium-s.p.93090983.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_Medium-s.p.93090983.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"6476c-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PM%2BTVyNDCy3ZY8tmPslvYqaRkXPzYV7uQANazPkAUhXv97pga6KnT9DCxE%2BuT0XVG46MHWQFkdXpXUwkw9%2BuYNGT1kFIIMdk3wQD7iHvRDaDatXO0VpNXqc%3D\"}]}\r\ncf-ray: 9c73b4834f555ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":411500,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter MediumRegular4.000;git-a52131595;RSMS;Inter-Medium","md5":"a473e623af12065b4b9cb8db4068fb9c","sha1":"126d31d9fbb0d742763c266a1c2ace71b106e34a","sha256":"1bda81124d6ae26ed16a7201e2bd93766af5a3b14faf79eea14d191ebbd41146","sha512":"1fbc2841783140fe54f3ab1fa84e1ded2534bcec3549ade2f513491b32178df515bd63a0a4a2c35017a6850ff9c3a24f8602357d912acf8ca92b8d68ba846d3a","ssdeep":"6144:D0RV3jlWkDOh9oC2wuhsJWPziKSQlRiFy34YmkCD9oI0+msvMlwt5BO2x28YzWDQ:D9SxC2wuhDPziK2yIYmkCCIPmsHI8F8","tlshash":"48945a17e706db0ece562d34cbf587d033a9bc91781ad247b16a3a19ce931b40ad71e2","first_seen":"2024-07-29T21:54:32Z","last_seen":"2026-08-05T22:14:11.431546Z","times_seen":288,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/media/Inter_Regular-s.p.b62ab84d.ttf","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/media/Inter_Regular-s.p.b62ab84d.ttf HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: font/ttf\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:29 GMT\r\netag: W/\"63610-19c15989c68\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KW%2FS7qG88SH0dkSbNjhiKGPN7dDfuTrRJXNx06W2gYmGwz6%2BlZ1A0EEDMtcfWDmInhDW3JIU9DL26w%2FWtrHJ6N37iLOP9bfs7mi4Fa083CTBKirztqpZEyo%3D\"}]}\r\ncf-ray: 9c73b4834f565ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407056,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterRegular4.000;git-a52131595;RSMS;Inter-RegularInter ","md5":"fdb50e0d48cdcf775fa1ac0dc3c33bd4","sha1":"5c95e5d66572aeca303512ba41a8dde0cea92c80","sha256":"64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123","sha512":"20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53","ssdeep":"6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08","tlshash":"30845a17e70ad70ede452e308af987c133b9bca1785a924bb59e3a58dd971f409cb0d0","first_seen":"2024-07-29T21:54:32Z","last_seen":"2026-08-05T22:14:11.394006Z","times_seen":495,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/f2c075ff8674f48a.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.676Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/f2c075ff8674f48a.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"a16-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FaVeZROWqXs2DNDm5vSkQui8Z4Tl3oMz6VJwWrMGnyOw10Eu3BQBX0KK02lCLHSRCzPlT1nZUGAHmYFcHXdHe%2Bhxs5YrIvI8hOxL3L88gvzjHkgACDxqsX4%3D\"}]}\r\ncf-ray: 9c73b4838f965ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2582,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2225)","md5":"3e91325fdd36d18a20855a2c09856311","sha1":"caaf5398f37f8edb868296e2a35966e9fcaf2261","sha256":"b85d8f984c98d529d06bfbb6a1d848d9d7f07a28e6205538a10b8f6bd41d850c","sha512":"29c916de66c4f6b31a883bb274035c052566890e60b5d3c0e2414787fa0b80ff98041a3942f19505466c2b4349bd406c3237a322f583ade569cbb6fa988118b6","ssdeep":"","tlshash":"005164e32b4832fc28ca10681e6b6113969c753f31cf90a49a4cc5f4a6cad88f26345b","first_seen":"2026-01-31T21:08:57.26314Z","last_seen":"2026-02-19T17:02:28.785235Z","times_seen":71,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/1d8278968b92360e.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/1d8278968b92360e.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"7b35-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wkXOj8uqoaGIfdc2D5x1Csti92rICpLqfdCJkCDrz2K%2FlR25j1oSCm7vIAzUQM1Nb%2FTWdrHxaLp4RaO6S7YT00v3K0kxODlOJkMf0SGdC1l8tMdcGqw%2FXhQ%3D\"}]}\r\ncf-ray: 9c73b483afa95ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31541,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (31184)","md5":"e5179e89d99baf52797f24105189d4bc","sha1":"d974bf4950afadea4a0076927f161eac3dfeb055","sha256":"86f986e1571bf5dda53da18ac84496726aeb00b3980533fd917380d68469a8b0","sha512":"81f677899b0eed324f5f70d95aeb73d92cdc1b0ef95693949b1c8d1fe7361a51c38cc1e114a27f6877dcb966419123e99441da1d18645337bc79facb0cccce6e","ssdeep":"768:qugNIiqWiEdR9uDFyXXyRYgx5RJK+wglNjzjaSGyXOu:q5IiqVts+wgTqSGyXOu","tlshash":"ede2da817411f87a89af92efa0e60462937d7709e0088624787f9e2c772d609b157f7b","first_seen":"2026-01-11T01:55:53.487198Z","last_seen":"2026-02-19T17:02:28.609324Z","times_seen":73,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/api/track","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"POST /api/track HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nContent-Type: application/json\r\nopenpanel-client-id: e2820c06-249b-4bc3-9f61-fafb2c624bb1\r\nopenpanel-sdk-name: nextjs\r\nopenpanel-sdk-version: 1.1.3\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-b84b697c73133043-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nContent-Length: 219\r\nOrigin: https://postfinance-user-auth.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":219,"data":"{\"type\":\"track\",\"payload\":{\"name\":\"screen_view\",\"properties\":{\"__referrer\":\"\",\"__path\":\"https://postfinance-user-auth.com/\",\"__title\":\"Postfinance-user-auth: Crypto Casino Games \u0026 Casino Slot Games - Crypto Gambling\"}}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\nvary: Origin\r\nvia: 1.1 Caddy\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KTHBVqW2vIGHTohObGZ5PiixrV6b5CBqHDPgcDyCnfCe4K%2BkmDF8Ygpub59%2FkWRCzu2Bt%2BeH8ZyMpSnS6Y5w8zAbqLTaS52hOBXvU2Gjlyvd5YEXDXS2XYQ%3D\"}]}\r\ncf-ray: 9c73b4901a3f5ebd-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T14:07:12.2636Z","times_seen":17762617,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/reviews?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /reviews?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-a1a33846b3458e81-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/reviews?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FThdWCal1SapKxIuRb116XQIgmvKYvCrS4qbTZ3mx%2FPQNH0iqQnOYm%2BTp905xkmxL65XyGS60X6dC1glR1UQKnFe1y8N7xMR87%2Bql7MLRGlcxCXWeKKhoEA%3D\"}]}\r\ncf-ray: 9c73b4975bab5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/dice.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/dice.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2390\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 18:08:14 GMT\r\netag: W/\"956-19b7abef6b0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xEfrGwyGUjmfAukg6r17nJrQykhXh96hJcOUa%2FYeoUYTeG09BHN0juvRoLVv%2FyQfkwrYSsa4j%2FUXSFsLKdC460%2Bsois9HbMDuzZwF7CqFSRat88qe2cI%2BnY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497cbe45ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2390,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x257, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4321a3197f1ab9457ef1edc8cb638de2","sha1":"b1eccd479b3023229103fe120e8527ddc765bb7d","sha256":"26b05e23fbd6963544e3f01f738a630cb4deb0aa7bf94462805c3d95a22d95d2","sha512":"fbf76854f7d7af55aff499175825cb1cecefcbacea89da3e7dd6556e850dd7a9486a006857293641db3eeeabe5ee5102e98130fe3f16a9f62484e4c3d90e0cf1","ssdeep":"","tlshash":"53416d04d1a1d7a450eab19c4229de634ec7d491f54463403f8fbebcc92154210eeede","first_seen":"2026-01-11T01:55:53.45306Z","last_seen":"2026-02-19T17:02:28.672387Z","times_seen":73,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/terms?_rsc=130jj","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /terms?_rsc=130jj HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_head\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-8ed9ed884d7916ed-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:52 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/terms?_rsc=130jj\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SpXfuwOGZY3Skxg0mR03i5i8YrRzOk70HxPG1xX5dKr8fcLlxez0hNEaxzSxVb9VNu4DYooAaTVaTJXUInuzsDP%2Fq%2FSGTxsmSw2msL%2BfUC5RLeCH%2F8jZbCI%3D\"}]}\r\ncf-ray: 9c73b49d8cd35ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1989,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1468)","md5":"9132dff607a08d95a5bf7e32265f979e","sha1":"0fc9e9399c8359f20e84cb3c1434ffba14c780c1","sha256":"6b59e642f0708b2cf20fca15f406d8bb9ab13a93792daa48f087cdc54737fb0e","sha512":"889c89582a18afc19ddb06f879b0d2f50f9884bd0543843914950fa84f04a4f81038d94f5b2f535057d645a119d696d2c83ab1d3d384bb3e2cb44b7e8db9dfab","ssdeep":"","tlshash":"8741217a890cec8d5a77c958086fe30a150c1673ca701e6ae6accd0e1ac603e4f60e90","first_seen":"2026-01-31T21:17:17.874047Z","last_seen":"2026-02-01T19:03:24.034177Z","times_seen":2,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/c9d86bbb7c4acdee.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/c9d86bbb7c4acdee.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"6599e-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9zMwQCWz7PTa0of7avElcm9mGG24pnnMILkndq4vhUrilNOduQOfui6KiCDldkzF9eo6cOe0iY27LAHtMQV5HQKfzZuO3KV8aAiuXycyuj%2FdToAKamxoRbk%3D\"}]}\r\ncf-ray: 9c73b4837f805ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":416158,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"375038ec8cec6aada72e25b152bbeef5","sha1":"c78b20a01aa625bdb0e1ab2358db14698586a570","sha256":"606e1f12073f6762a118cf232414bf2899bf3ffd6f7fd06ae61dd2363cd682aa","sha512":"97d64ef9834f0b04009a43f212061a31b40a484389b2959a10b49264597a5c6a9a2af0e7b45d248e3bbce3d70e036cee4a77bf53eaca3c7f7a670ab7d43b1c5e","ssdeep":"3072:ueuxDvbX1azHazaNQNYBr5XtP9hO9R3+VQVhUGHTbGpLsev6ns4xlPfetAvJQXEM:ueuxb7jV2ECNvms+lPnjz6x","tlshash":"2c940888b760b022835666e0052f944fe27ef92d6c4a44bcf654e8f57cbd889653bf34","first_seen":"2026-01-11T01:55:53.513192Z","last_seen":"2026-02-02T22:33:10.118728Z","times_seen":69,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/5b4c38a1263b182c.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/5b4c38a1263b182c.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"14f0-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IOcG8%2FmKt%2B4nsb1Ii25P2wz%2Fzu4J1i5L1XEQ7VhYY410oktlXXyICwWuntq3KzztJ%2BqfpgSfGYOMsbZI1BKMhXXeyK00T4kZ%2B13hlz7i3tbWMQmISYWmUBA%3D\"}]}\r\ncf-ray: 9c73b4838f945ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5360,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5003)","md5":"f8e9ec1997bd5d30fc21d00e4ead8870","sha1":"204eb1cf4545e0065728e78078f652c93127da73","sha256":"f2ad2659ebf3d8c610e1d765790329fb17c236fc2cce6bd92041802c1f8446fd","sha512":"37dba0ba6cb75187896c36a05d8ba09efc92dbcf9be03b47a1a4840378161d97b3a9fd1928ee668c4794dbda8d37a7dd72e66ded40f9180d5af18d433f199748","ssdeep":"96:GDj0znt1HChTQV4+NBBBKrTukNYx5bLOPtFffaFAbkqiWFTTGD/TMAI:aoz7HCcBQc2VFffaebkqDQw","tlshash":"98b134d4911c42bc985523a8522ad843635d10ff35bb5ea4d9afce60a2c74cce2a74db","first_seen":"2026-01-11T01:55:53.429255Z","last_seen":"2026-02-19T17:02:28.608647Z","times_seen":73,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/flags/US.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:49.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /flags/US.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569520%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1728\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 20:56:37 GMT\r\netag: W/\"6c0-19b7b591f88\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J7%2BGAq9m5IXmGxcq02DkiFzUl7hUSQGvjA1%2FSyfu9LVGrk9M5tfH3RooKkqJdx3dQDWbdlxeDouPfG%2Fs%2FQWKybQCwGbRnQCj88beIwp1LqaOF3V%2FZ3Tu%2BOM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4913a605ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1728,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d5b2ad4da5657d21695de35554777081","sha1":"1cdc99c99f67962995af22fc9c811f94b72d53ac","sha256":"e3a1cbe55c01edaea1f1715a1593ff2a0685067bc0c5d77aeca7f27fe3a630b4","sha512":"c69e0989ba173bf00495affc2ee10a77cd8a5dd8a05426985c0db982ce8cdc22f376449fd57f97966526fbd4ca0332be02decdf91a0f8e4436cace537a20e39d","ssdeep":"","tlshash":"653128758f3056cae7dc0d60343094e0a3efeddc8b280e293088fe0364f1626785aa60","first_seen":"2026-01-11T01:55:53.490895Z","last_seen":"2026-08-05T22:14:11.436682Z","times_seen":108,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/group/slots?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /group/slots?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-86a66c16b6bbe0c6-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/group/slots?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ltbxY6TXkCo7dW17XyM8SRYOGT4n%2F3lLig1lP1PvgjB4xHrEiPGFme1it6aJCynocas18pi88J7ZvwtRz2efHDow%2BgpkpG1686rRAsKKObbQvxHm6P%2FWgEM%3D\"}]}\r\ncf-ray: 9c73b493fada5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2588,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (1079)","md5":"5ccdab88bd2c09a2800a275969c69344","sha1":"ec69adf9d164ed7a73ad5afd851c1e4fe86781af","sha256":"1e1fccc7fc544c9c810221deb590fdff8c1fafaa0e4a099b01cafce9138fe17b","sha512":"5a0c9d998ee9faa9f01b647161ae3b321632c65e9210eb7537d20fc525795534e9f61ef3fa37dc77aea00747bab197997e06876e48422badf565f4f623af6c08","ssdeep":"","tlshash":"b651a00dc849adb498d9d5c962d5d7012a94af37f1b88da8e04bdc54138f03d0beab87","first_seen":"2026-01-31T21:17:17.986628Z","last_seen":"2026-02-01T19:03:24.220982Z","times_seen":2,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/9c439f77bcf7138d.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/9c439f77bcf7138d.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"ae89-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EDsevA1dDRAQVIyQ86%2Beu4jDNYHzXQk5XklHGNboBBualDT425q50r%2BcKOZC6H9yGjIbTi5yA2K75ahLk%2FVNBj3TXjAf%2BXj9dN2WrOL%2Fxvj95rBfT1DTkYI%3D\"}]}\r\ncf-ray: 9c73b4837f825ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44681,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (44324)","md5":"84c3a7bfbd13e6eed8ef2600eaddebdc","sha1":"492c5eb4c2b6ea7d50aa47251107d02af9a99efa","sha256":"c010c5927a47a70ff2fba12a2c2fc224103a5ba1db45bff25a3c4ff53a7ed2db","sha512":"ba4d7713a6c6d0abc5f738d03df05c512d350afb9d0fca1ab43758499c61f0a263f9cc412611e7d64cbbb82481b03ea62829c5cd8719234fa3f46bac724dabcf","ssdeep":"768:B7Tl+Bi1HaSiLD3XirHJdPYKENWNDRYEpEzf9MSnS61ls0c2kXBdnXDnI8qhxCYb:B9+McSiLD3XiWIDRY0EfUH1XMOYb","tlshash":"2c13d8da73607251a3cb515cc4af0b81733758ec2019807c3a7da9cb69b0a5976bf73a","first_seen":"2026-01-11T01:55:53.441745Z","last_seen":"2026-02-19T17:02:28.745023Z","times_seen":73,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/vip?_rsc=14bpo","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /vip?_rsc=14bpo HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /_tree\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-93697e4673928048-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design/vip?_rsc=14bpo\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: STALE\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lczWp6dITHNCc2HVlT8j2QFvBxs8pkWoUSp1foBBQ%2BC6b6guwNe6wp5ouAeh9O%2BagKYl9WEqV4IeRu9GnPsSMgG6ny6wUHkwRVW9c7%2B6R3JKL2AeTBEu4Mg%3D\"}]}\r\ncf-ray: 9c73b492cab35ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2463,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (954)","md5":"7e5f58fcfa8b7117b5b56d88bc67828b","sha1":"67751cf9f6dbbb0aefc2920fe1a6617f87caa80b","sha256":"afae8c976d042faf85c2695ddedf8097499dec1e3ca3a25b01a3d7593601dfc5","sha512":"e745d5883b286c418890cafc4bf93523ec2d7f8ad3abda08ef575f0f336e0c9e0ee9bcc7ee5db2b7052822f757d6e711021f1fff57a910e8a54233d2b4ed13ee","ssdeep":"","tlshash":"7c51ae0dc809adb498d9d59d61d9d7016588af37f1b88dace04bdc64038f03d0beab87","first_seen":"2026-01-31T21:17:17.890427Z","last_seen":"2026-02-01T19:03:24.224223Z","times_seen":2,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/?_rsc=77ulh","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /?_rsc=77ulh HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance-user-auth.com/\r\nrsc: 1\r\nnext-router-prefetch: 1\r\nnext-router-segment-prefetch: /!KHVzZXItc2lkZSk/$d$M\r\nnext-url: /postfinance-user-auth.com%26blue%26en/second-design\r\nsentry-trace: 4b13851acc4942fcb71e62c6a8353fea-9567e8180aeeea70-0\r\nbaggage: sentry-environment=production,sentry-release=web%402.9.0,sentry-public_key=6d319d1014d598ea4a0365923853ee67,sentry-trace_id=4b13851acc4942fcb71e62c6a8353fea,sentry-sampled=false,sentry-sample_rand=0.48296319295770473,sentry-sample_rate=0.1\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972569865%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: text/x-component\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nx-nextjs-rewritten-path: /postfinance-user-auth.com\u0026blue\u0026en/second-design\r\nx-middleware-rewrite: /postfinance-user-auth.com\u0026blue\u0026en/second-design?_rsc=77ulh\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-nextjs-prerender: 1\r\nx-nextjs-postponed: 2\r\ncache-control: s-maxage=600, stale-while-revalidate=31535400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OnI8kQKbx%2FgPoYVeyGRSaFM1cCBMK%2BKoiqHCgNuLWY%2BUaA1kBnLJ8YZC84IqXXugo1KgzlOXvs0cV7SRXHYBjTWjS0mA4o0BKkyH1%2BS4KNsGq62WrFrgrX8%3D\"}]}\r\ncf-ray: 9c73b495fb715ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3117,"size_decoded":0,"mime_type":"text/x-component","magic":"ASCII text, with very long lines (2729)","md5":"5223d8685548155fdd630e6b058fc8e0","sha1":"497a177115a55ffa7a0fe48780b48c56d80388c0","sha256":"c5ef22e22070715f72d95e5775a76d8cbe0d4cd758301f92e7def6d7dc13cfd6","sha512":"1408561dcc538d93b4719ba1418deebc8ae146fa15263cc2e58ae8a0bfb2764e763c26837e959b01ba9abd99733105d7a36e91402b57f7112af5db2440260db5","ssdeep":"","tlshash":"6551307d120aff6c6b6b0548545dc32a676e4a3af7738e76e2fc4972134a0349b832c4","first_seen":"2026-01-31T21:08:57.212644Z","last_seen":"2026-02-01T19:38:23.427874Z","times_seen":36,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/plinko.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:50.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/plinko.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2356\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Thu, 01 Jan 2026 18:08:42 GMT\r\netag: W/\"934-19b7abf6410\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n2iO9BukQJIiIEf0hYssh0pnmpBw6JZzM9QpQzJeFUJnmbNHPEWc5jvKDblOm3CsBo4H5p1wzxeXtUCJZmsjilv%2FvTWb5BtapusYoAvsiqqtRTiW0SfGnQU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b497cbe15ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2356,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x257, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b7d9d76919e7318a5ab3820f0b2acf39","sha1":"799ca8a6f171111e9a5327dcd6164fa7f048750f","sha256":"293bc6e6d78141aeed6e9e5a9ab93672246c8242e29c205adaeb711cd3985011","sha512":"28d4db6fe84750a2b3544e1ebb9fbff3fbf485aad0e9a904463ed8bc9c424e40343a090814bd0743dcd25220c95bb87e49d053c1b6986ed60aec3def0a634450","ssdeep":"","tlshash":"c9415db53ea2cce67145276fa4abc9084cb09bc175c63807c2e87ae4825b6184ec584c","first_seen":"2026-01-11T01:55:53.452287Z","last_seen":"2026-02-19T17:02:28.805601Z","times_seen":73,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":100,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-888-gold.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-888-gold.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33914\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 12:00:03 GMT\r\netag: W/\"847a-19baced79b8\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MuzTaCg0G1GkoHADZ3ROvvQgqkEX6K8oXrfkk6yKi%2BPBnvEqTKTCeaLr6iReB7EexFOry7Ao7tiz5m8FQXYnIvhoij%2FyVsWbUkcSvrnbs%2FLTHgkw8l0vvvo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4998c3d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33914,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"67269173360d787743fc7408eac09b8a","sha1":"b81d7879445b24567da9b760bb0fa7026498ae94","sha256":"1b43541811103e958b617364563faf592634456dcf389fd6ef2fb5c5ac7b13dd","sha512":"957ba412a4861c86be0ccb8df185b99f19d654e099e5a252bc8a255c71dbff70fecd651614f838064b3f8aa3988951dc57e6bd00d321981076c30ea69332382f","ssdeep":"768:vx8q7LumnsFdT2bfGIpC/YJO2fkTB00rrIdU0aJyvo:t7LutFdqo/yOWkTB00o8Jyvo","tlshash":"3de2e1e08658fb9994e2b199eeb34ec706fa41f3dc5828b781ccbd5a54f192815c3309","first_seen":"2026-01-31T21:14:50.703297Z","last_seen":"2026-02-13T20:55:00.8129Z","times_seen":35,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/second-design/ranks/bronze3.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:51.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /second-design/ranks/bronze3.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972570821%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6220\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 09 Nov 2024 04:16:53 GMT\r\netag: W/\"184c-1930f239f08\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LUWXPs4KMWWd57nimzS1hiYCtx9woVcTbF5o%2B7z8LMctkWZLHFP4f9g20eQhAKru40dfW6a2gImza3WE9%2Bdf9W8D9h%2B06%2FlY7HOj8ST6NaSjJBR%2B2DjwgMo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b49b5c785ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6220,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f56b5ceebf9db8e4bc2f43d20705b7a4","sha1":"3a0f8c7107bdacb95ac1205f247f1e2289d7ff7a","sha256":"6927df57077ad75918a5ee983f4958403e35feeee586f1fe6a2e37d9c290349a","sha512":"ad6f47faea2649b779d896be6172e08ee35622dd5a096c27e1183df06a83031417c55082fe49fa684a37598e5af554c7be176fb9437f69b8a83313d47bd6e0d9","ssdeep":"192:YIajPDawjYKw0w+GxgCSZWHnXETl8RdJrPFerpV:3uPDxjYKW+GxvSZInXeA/rN27","tlshash":"08d18dbb12c6ab48091c26d6161c7e9c85f53ec0356ecf4dc032a85fe10b8f17a3864a","first_seen":"2026-01-31T21:15:14.958629Z","last_seen":"2026-02-13T04:13:07.687567Z","times_seen":38,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":413,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/games_new_webp/pragmatic-play-beware-the-deep-megaways.webp","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:03:01.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /games_new_webp/pragmatic-play-beware-the-deep-megaways.webp HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nCookie: ph_phc_TpHAAocKveEIHU2YeWxKfygDoEV7LC2bCq4mEaD7luN_posthog=%7B%22%24device_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22distinct_id%22%3A%22019c1a96-158c-7f26-afd3-ebb2eeb1b3fa%22%2C%22%24sesid%22%3A%5B1769972575215%2C%22019c1a96-15c0-74a9-9892-42f6126f609f%22%2C1769972569520%5D%2C%22%24initial_person_info%22%3A%7B%22r%22%3A%22%24direct%22%2C%22u%22%3A%22https%3A%2F%2Fpostfinance-user-auth.com%2F%22%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:03:01 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29026\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sun, 11 Jan 2026 11:59:50 GMT\r\netag: W/\"7162-19baced46f0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P2eLuwz6qrngo444j0XBBI3EZk%2FG%2BfTWwIvTgKwIKt8CWFA1sEXUOVDJbH0TBRjAVdzIkyRtxljYYXcaYrdGGyqpyshvPlWNCHYfm1%2FRtBC0Fal2M7WSXbY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c73b4d85f5d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29026,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 408x546, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"be08c0941a22655edf60766feb5964c6","sha1":"b766caa6b2e360df8158dddce4a7ec1d63266517","sha256":"97642f0df01c551bb1296212125f457f9aad439820248406737880e7fefa3ca4","sha512":"d6b0b57f3a04bffacb90fb12f087bd81a1d23c6b801eed053f38f1551b116affc4e1eaf37c9f6f3775ccf2cc42eb8eee60971a98de80068442a67c7d68408527","ssdeep":"768:+W+upYvNmrRs9FILRUGa1kutYF/hmS7zIGfmrQBmAeFarVfPd:GuiesT0PaBtG/hT7zpfm0BPeFaVPd","tlshash":"86d2e0eb04f7095f2c301443f437fa6659a9bad27a9b5a950978b200a0393fd6d20dc7","first_seen":"2026-02-01T19:03:24.228699Z","last_seen":"2026-02-01T19:16:16.948782Z","times_seen":2,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/08c39a0012534f66.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/08c39a0012534f66.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"1b32a-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dJ8Hw%2BQ7joZRe972Fla7SsDlgPbgP%2B6P6mNlAAUJD%2BAcQ03I9X9UH4xUEDuf61iS7LRpy8wG59k7ycWB1hqdfnUS1r4NvMXdks2y33xGSCuzVEPnbu%2B9piM%3D\"}]}\r\ncf-ray: 9c73b4835f6e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":111402,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ff39d75e72b017105228a3e3937e7591","sha1":"f2d18c32727ea5c8c3025c3dd6062cc64a0205bf","sha256":"bde5066619da447ebe65deb46930149c780552d9aeaea4827915013d287be571","sha512":"cc6a711c714a6309780c59e28fe35a28e70d35720b3c4f0eb25986f230329c1a1e047514909fc053fdf56233194352b7595f57e4de1271c715d0fbbc315a5cb4","ssdeep":"1536:0N29IxBQi6ha/rqj4gUnFZSul2PmOot685j:05P6M2jDRuPn6e","tlshash":"73b3f7f935d5f48207ab40a6c03f0006f32c5d37189e68a0a3e5ddda756499de1b3faa","first_seen":"2026-01-31T21:08:57.335286Z","last_seen":"2026-02-19T17:02:28.643844Z","times_seen":94,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/def7cbf195df9f5a.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/def7cbf195df9f5a.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:31 GMT\r\netag: W/\"81f6-19c1598a438\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S%2F1LwfhZJmDbDoI8txxsEZpV2CVw8OoJ6wBbVrdz5xYiGtf7XU%2F0HkJxL4SB4SAhbCS8j5sSbjdM7wiKYAb37yOGS2RrahS7uVdaxvuZRjRdzRRWEoMDOJo%3D\"}]}\r\ncf-ray: 9c73b4836f7a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33270,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32913)","md5":"971912a88b8fc321b1e02c9bfdb119c8","sha1":"13a51b0bd9f9f2c32118f3d9316f40f973a5323a","sha256":"7514ca2d94bdf7565bf10f198d551a4a1b715765d20f7587aeb1591b808686c9","sha512":"bc0517c20439d8656f1c01310675031fcbc20e9b2d1ded2ab2462d47e47342d72502c75d35953d2b1079a3519a71e73ff18197b7b367a85769c427b44198fa63","ssdeep":"768:a4HG0/x/V2i4d9Im/22FljzYvX9ia9Qsm9:7mox/V2zdWm/22P3YvX9ia9Qsm9","tlshash":"8ee2d8997241b2677ae28196d83f0116f2242926140d803c76a9bcf77863dcff57be36","first_seen":"2026-01-31T21:08:57.211453Z","last_seen":"2026-02-19T17:02:28.670347Z","times_seen":71,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance-user-auth.com/_next/static/chunks/48f61cc265d47694.js","fqdn":"postfinance-user-auth.com","domain":"postfinance-user-auth.com","tld":"com"},"ip":{"addr":"104.21.13.185","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance-user-auth.com/","date":"2026-02-01T19:02:47.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance-user-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 04 Jan 2026 09:29:24 GMT","end":"Sat, 04 Apr 2026 10:27:03 GMT"},"fingerprint":{"sha1":"5C:47:3F:D7:D1:80:B2:27:D5:B0:FC:07:09:C4:27:58:08:A8:11:78","sha256":"0E:AE:06:3A:35:ED:1F:C2:43:EB:37:7D:FC:98:94:3A:3F:E9:01:C9:D5:AD:07:83:E6:8B:F2:61:CC:26:C8:A7"}}},"request":{"raw":"GET /_next/static/chunks/48f61cc265d47694.js HTTP/1.1\r\nHost: postfinance-user-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance-user-auth.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 19:02:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Sat, 31 Jan 2026 19:47:30 GMT\r\netag: W/\"ac9c-19c1598a050\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fvo%2FRVU6%2BsxT6omaI8r2nd0Q71KU57%2FtkJkL8SUMCQWZeaT3OkaVT%2Buw6EuYX8sklDYzygY0H57%2BfJey4aZ0EHTiwz6nSF6tPv40pDw17IWGQlN7tkvltkc%3D\"}]}\r\ncf-ray: 9c73b4837f7d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44188,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (16970)","md5":"dee46bcb482bf82bd4c1029f187c68ee","sha1":"d7cf4d6188a9313e31590dacf5902ec8b1f1b311","sha256":"1943b9c626e8cf07bb3fc5f19f03effe59f3be189438303a477919db148bfc7f","sha512":"ac80a472ed1005853052a9817975646693f125531cb9f9d5ce6d69b490caa8c18bc06077c18d1ef30fd5b71d39b97c7fcec9559537c9f12ecd8c6e972743b9a0","ssdeep":"768:UjLnQztxulYXI6KJxcoQNLE5k96UJGSgf5djPZ+a:aLQYcNLGk96UJGSgf5djPZ3","tlshash":"d9130959b021ecbb223bc1fc906e1416b26d5d79e31a6a24f3ff896c131494531a3fa9","first_seen":"2026-01-31T21:08:57.327027Z","last_seen":"2026-02-19T17:02:28.753031Z","times_seen":71,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-01","alert":"Phishing Block","trigger":"postfinance-user-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"postfinance-user-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}