{"report_id":"db6905d1-7bc3-46ed-b74b-436c124b3afe","version":6,"status":"done","tags":["swisspass","phishing","transport"],"date":"2026-03-07T12:46:48Z","url":{"schema":"http","addr":"ch-login-swisssp.serv00.net","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":0,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"final":{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"title":"Anmeldung | SwissPass","dom":{"size":39,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"086707e4369f60afedcafb16050a7618","sha1":"8216b0cc6876cbd44f01c158e7dff3833ceccd41","sha256":"a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e","sha512":"aade21843813e2cab329b99185c6f61db7907a556ea974e0315dcf3ad967cab20fee66d4f10db0d0ec43a71e086ce6d700d5524103deaefa3ce5f6be74ba5737","ssdeep":"","tlshash":"6a9000fee0a2000efc303bc00cc2238a0c28c3a830028e002ac038b8c80822bcc032c8","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"2023-03-07T01:03:24Z","last_seen":"2026-08-19T05:29:34.457693Z","times_seen":1039302,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ch-login-swisssp.serv00.net","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":0,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-11T12:46:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"summary":[{"fqdn":"cdn.app.sbb.ch","ip":{"addr":"51.102.173.7","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":2139371,"first_seen":"2018-04-04T14:01:55Z","last_seen":"2026-03-02T09:03:07.870827Z","alert_count":2,"request_count":2,"received_data":29918,"sent_data":1090,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"assets.adobedtm.com","ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2013-11-22","domain_rank":3051,"first_seen":"2014-01-28T04:51:35Z","last_seen":"2026-03-02T03:35:16.713095Z","alert_count":0,"request_count":1,"received_data":131181,"sent_data":472,"comment":"","tags":null,"fingerprints":null},{"fqdn":"geolocation.onetrust.com","ip":{"addr":"104.18.32.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2004-01-12","domain_rank":4022,"first_seen":"2018-02-07T11:23:41Z","last_seen":"2026-03-02T01:03:11.556984Z","alert_count":0,"request_count":1,"received_data":461,"sent_data":511,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ch-login-swisssp.serv00.net","ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"domain_registered":"2019-06-03","domain_rank":0,"first_seen":"2026-03-07T12:46:49.811926Z","last_seen":"2026-03-07T12:46:49.811926Z","alert_count":40,"request_count":20,"received_data":820192,"sent_data":20195,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"OneTrust","description":"OneTrust is a cloud-based data privacy management compliance platform.","website":"https://www.onetrust.com","common_platform_enumeration":"","icon":"OneTrust.svg","categories":["Cookie compliance"]}]},{"fqdn":"cdn.cookielaw.org","ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2011-06-20","domain_rank":2972,"first_seen":"2013-12-28T13:20:36Z","last_seen":"2026-03-02T00:47:11.844501Z","alert_count":0,"request_count":10,"received_data":742192,"sent_data":5089,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"assets.adobedtm.com/15ff638fdec4/7a0c4d63ddff/launch-6cc731e967aa.min.js","fqdn":"assets.adobedtm.com","domain":"adobedtm.com","tld":"com"},"ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"db5d6811a1b0edbeaf0efd5259dba9a6","sha1":"a79d8b1a06b1d2259851adfba3571be632423fe5","sha256":"465405fb9724046f8c3c0f83ba4d5c58592e663b6e3a73fb8e661ad790ff97fa","sha512":"87f59e02a8a42b8ad814f2d2fbdbe784738adfcf4248afc459d859cf88b930623d614e30f90315b595b595c8ab5cdca20669b1065aa2b55e755ee708ebf04c62","ssdeep":"3072:NQmN8LbsM/ESbPbKPbKK6jHKlVz0riUNKeu8yVgJbx7PXV5UCmglQ:NQmN8LbsM/ESbPbKPbKK6jHKlVz0riUs","tlshash":"3ed32bccb2d5b41503eb3279961f200fb27e6a84685d8010eea6edd47d7a60e5373e6c","size":130651,"data":"","first_seen":"2025-08-27T17:30:53.00956Z","last_seen":"2026-08-10T12:28:55.915747Z","times_seen":83,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"713aeea58cd01d7b9ac09bfcea2367e1","sha1":"0edb9d4d94e7eaec5ece698656d35f26913eb570","sha256":"cebaedab49b32eba60e39fd9412496c01d842a714005e33c90a1a6bdfc60a558","sha512":"9882eb09b5628dea13b4b16126c436e3b4e2b0c4696a5e42faf673f62cf522ba110822353f52f0ac51d167bca736d6004722eaad4cbc207f9f9d7abc3d74477d","ssdeep":"","tlshash":"87b092600217080c2aea518d1f4fb314b01ef0a226d0aa253dcc6a08ab219137280ee0","size":122,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-03-07T22:25:55.111829Z","times_seen":1203,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"af6e188f8e8a8e651edb9c2b3bc92a96","sha1":"a1359d735cb1e4547ee57b0f364c3c389f000562","sha256":"9136713a058843bd63557e0aeef78012991e62e02802cb972d6b37f79a3642e5","sha512":"3adc7c3611b5b4009758da9c71720e7a8136bc712dff51c0e00570b3fd7889d5c8abf9ec2a49254f5c719702b49117af1a31b852959f6caf43438e224ff5aa9d","ssdeep":"","tlshash":"ec21515c8a7e0019209b30ac2baf6300b038a0836904bc353f9c7805af1da0f99e5eed","size":1167,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-03-07T22:25:55.112606Z","times_seen":1117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"801a46fa9aeeaf954acd83bf806928d9","sha1":"1f04f3395a9267b3b49f05e332faaf526083d8f8","sha256":"bb0e4a47c01bfbef3dfe6bab3fa0c8b411b201a287702a2722d155bd1a1b6298","sha512":"8cf47756c901a4e6ca0bb3a0ef3a49266cefcb2bb323580a07615ddc6ebc36da316d844b5b1cb31cf4cbd63785d07189bd789f5ab93b5191f2f41cbd82cd381c","ssdeep":"","tlshash":"5a219c0766b2993098f6a0e40eafa92034b159135585d1d5bf5e9b044f00b1b90326ed","size":1345,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-05-20T11:50:07.981885Z","times_seen":1212,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/vendor/head/modernizr/modernizr-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":false,"md5":"1fa235981d7cbf5eb6098a7523afc383","sha1":"b764fad44ab2448d9924c2b0cf73ccee7b768c16","sha256":"7a9fa521a58ee93001981f3a7db498c589233d8cc616e8d09af0119388a865bc","sha512":"6df81d5e6524a92df4288e1a3309bb28c671e4711723a61c625f76f65981893599889d5647f295ab99737b6e9a3f263ddd02e32d3cf78d92ec89c2ffa21c7d9c","ssdeep":"192:tH4uMlSHW5nMIMzaGuX81KQob1dHYPeIny6RX:BHMgHW5MvzaGuX81KQoZRY5y65","tlshash":"80f1b88d7162b266479b5177507f870ef27898aaa9184440f09cc9bcbe74cb8437bf2d","size":7772,"data":"","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.107693Z","times_seen":604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4f26d1da47678006e67e5fd79a88ad9","sha1":"fe725245d62d62b88207e35da5fceb09e43aac50","sha256":"d7d7889cb348f7e9cf13d05d8eeea3a489b72e8ab58bb74d2cf729a3ab1d0377","sha512":"a2a0696279a2afeccbb24ab51c590a7bc60e192a2568863ac76a135527f2130ee32433406bb9d3d871a1fdd304bb87a38a880d231c9b3d599204125884682ce0","ssdeep":"","tlshash":"0aa002dd98a7620955f3343b8fdf3208207741b7044c9a00790cda505f6572f4a57bce","size":78,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-05-20T11:50:07.983315Z","times_seen":1211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/.within.website/x/cmd/anubis/static/js/main.mjs?cacheBuster=1.25.0","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c02e946fe528329cbd6a7377e12d4566","sha1":"570790a9b79df546ce021088e1e68bbd511f2a43","sha256":"26fabe452b0cd62327c2f5139c56173703a035442dd890565af1e72a8864cb84","sha512":"94deb8d40d3c42fe925d5bd7cbb2e95aea655afae26c53a7ba2793d9f2e2fccd9582ceec5ef120cc68d22efdeaf5019e243cf64d867a975e58bbd134d14d3f81","ssdeep":"96:gGKupQHToU8oMLLXlHPX58m1pw/WCytfOxH766wyJIT0OyQxkMzC7QvA5mmIzJ1L:gGFQHTqoSPXT1prCytWxyyJIT0OyLJmX","tlshash":"bfc11bb6713d967302df27333175a38972321098159f824440ad8a25133ceaeb5f7fd4","size":5791,"data":"","first_seen":"2025-12-29T02:55:37.254872Z","last_seen":"2026-08-18T08:23:07.582158Z","times_seen":1317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"399145ad4b661f389b189a7859447fca","sha1":"8f84097c65c1ae82fa7c9f44af016277d44f5489","sha256":"d79ff28f0b8b29873e29747e25953c44056b945cfd7d66bc16442950676deed1","sha512":"e2c0277fd90422b7adb120ec6106b13d6ba6ef1915ae59fc79c41b9fcc4ff0f2118433b6854f589a6b96475e84a19ff1537d116894e452e9c42c7d90f59468c5","ssdeep":"","tlshash":"c071ef185af30415ac7330ee2bef515536a054536089cc8c3a8f97a09fe0ab6d771bf9","size":3570,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-05-20T11:50:07.98535Z","times_seen":1207,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":true,"md5":"1f11ff1516de147edbc859172b88b90f","sha1":"ff41ecad197c7a41e95c051691f24f7c4809ecce","sha256":"ec11e1250a7ae1b1b398c4c87c7faff45940cebf586c6ace0a61bc0cfbffce47","sha512":"d528765344ea4bff212806521c99f57f4af68b959bd4847915dfecac6fbe7da9894fef71b424324bb3df4616cf1d8bf90bd3f7ebc93cd22a61f39d95ab3a64c0","ssdeep":"","tlshash":"7611eb36d91311411de338293f8eac48b4ec801b883ac444398f4a20df83d20a9bbedc","size":874,"data":"","first_seen":"2023-04-01T10:47:26Z","last_seen":"2026-05-20T11:50:07.986009Z","times_seen":1207,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/primefaces/jquery/jquery-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b6c9978c306ef264158551c140a4c475","sha1":"a8316d0f66cc97376d60ae86a47c7efb3b8134ac","sha256":"2b2485b0669a2f73c4846e82eb5a37421358591a8ac8ba21d8149bfb88adcbfb","sha512":"0f69c70c3e54bf7f7fa24eecfd86d07a7b868016c55abb889a0c4a0bee3081fb60098f0f1bd8ba905b6cbb30b50af6c9dbfed70863baece4be2b54bd977d966a","ssdeep":"1536:rYE1JVoiB9JqZdXXe2pD3PgoIK6alrUSTJuFk/zkZ4HWLZoHsrOa99fwkKb7/HpU:q4KZ+23WLZICOaLfwkK7qD1Paca98Hr/","tlshash":"d893e8d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","size":97368,"data":"","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.109308Z","times_seen":541,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/202510.2.0/otBannerSdk.js","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2c3fe34db4c7fb1c4451892bae1e4a0","sha1":"0488250e210aa49c5abeedad334c8107dccc0f48","sha256":"7c549dad313b677b15cb870dc18f00ddc3a7aa549f53aa09dfdacd5db4d9e2da","sha512":"d9663383e52face86d43fcd4075cadb66e73819c3d8060a48c72daa58af2caa5702aa680da47639a71c705e4dab6327954aa147bc299748881fbfa71474f58a3","ssdeep":"6144:gh1WDttuwivNGSwMxnpNE7q2q20+bcVw1culi/rQVa1jdpSb1zHhE/beC:guuBNGS7xnpNE7q2V+QVaYtYbN","tlshash":"81b42a4e7590753587eb92b8c027414aba35746cac85806cb45cc5f90bf9f821ea3fbb","size":524879,"data":"","first_seen":"2025-11-05T01:38:18.209816Z","last_seen":"2026-08-19T02:38:49.846129Z","times_seen":3951,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/otSDKStub.js","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"573b916dffd563ab46c74d368270a3aa","sha1":"40003565dcf647758cad0b4891f197597f6be9a4","sha256":"15a5a919d4b2c63b74bac3c0752f7faa08675d5ecaab478032a0232013a2ba6a","sha512":"c49eda7b535bc0aac36eb1c6f508095fd704061e5a1014b276b0832d9b7a8b3d83b91cbdf3e24bdef82472871dbd7ec6f830193c0f52111cb201a217acb2d448","ssdeep":"384:F58KNPpfxrLWMABwX/XmSH6rCZ2rt8ekDKlCmXCcpLKZ5Q8eFKJx6yzGq:bdxfxvlABwXvmQZ2rtGOCs9CWq","tlshash":"79c2d88db540ee3446d361ed9a3be25ab23a746d3489d068b894dce0247cc4f6533bb6","size":26546,"data":"","first_seen":"2026-02-23T05:11:33.48285Z","last_seen":"2026-08-18T15:03:44.649112Z","times_seen":13697,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/vendor/vendor.min-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8ae9313d64c63be74208ff6564a9c83","sha1":"2d76425f12d558c47f76e9602665b7001c51630a","sha256":"f5e694ba6b63a657fae3f561dc0e8ae0247534616d9e844005d11d8ba2535338","sha512":"3f262f556fc794d8e779c2f43d8a6fb8468ea1e79e0369aa58399bf41c5806d0badb0ad69d15f7c021bf256b8b6a74a316d5808e5db4ee01c6840fb1f4a353e5","ssdeep":"1536:pSgDCs3fXCLcMpW+3moWgWngVaSBNdAj8Seh8C0rjLOYnQkTWqBC367JIAYQtokX:pSV3moWJ3pWOrsUk367JIpSi33n1O","tlshash":"d304288d7562313142bf21a6107f110b72379fbeb4058558b868c9d86ebec45227bf7e","size":182041,"data":"","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.107182Z","times_seen":473,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/swisspass.min-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8deceea0458745a7c0f562c65e01e27","sha1":"850c4796889f9173e30e016916155941cab3ae31","sha256":"9c50211b34ab0377f3b35c243c98e402315127bfa5b51e147cb22c702174ca60","sha512":"17d7d5daaa8e1c864fe21ce96782f33b45a907820a659e34ce760dad6d62895e92270d4073387ed5d563447c0f952e9369bf37aaa323b7b80912df3b5df13f9f","ssdeep":"1536:gj5taENXUembGTAC/gLf8XPpzaaGNZIMcSPAZAcSH5bVRLbErz:s5taE9FLTWIPpzaaQIMvPAZrSH1bErz","tlshash":"38a3da0d705234b72bff30f7147f620591336499b8454c40b26d9ca61ebaa4e53afeae","size":99344,"data":"","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.09795Z","times_seen":551,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T12:46:26.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:26 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-store\r\ncontent-encoding: gzip\r\nset-cookie: anp-anubis-auth=; Path=/; Expires=Sat, 07 Mar 2026 12:45:26 GMT; Max-Age=0; SameSite=Lax\nanp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; Path=/; Expires=Sat, 07 Mar 2026 13:16:26 GMT; SameSite=Lax\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4442,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2504)","md5":"f336e9d78a111b7e3bd76cd1c43731c5","sha1":"ff9f2fd1edbef86d04b38764a5405e5852b6a99b","sha256":"fb5ea3de34cda00306e96983da874d46e37f2d85ddc220e2a5566beda34cd0f4","sha512":"7a2db8b05871f5dd3520d53b59811706b61a636175d9db369c745004ed7c6437a996c3c32dca2ba6997c1f66b8be4cfed06d149ae4516f107900b1596afb89f6","ssdeep":"96:zJawDlRb9/GH0EgCwbnvOx2dDvZscvEUtrNnFN+qGtuDsb:TlRb9eUEtw7v+0DhscvBNnBob","tlshash":"5891d8539c69c04a0e834dd57ba0a79c772ac0178b0acc187dec35669f867bc4277ad8","first_seen":"2026-03-07T12:46:51.704711Z","last_seen":"2026-03-07T12:46:51.704711Z","times_seen":1,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":121,"dns":55,"connect":27,"send":0,"wait":29,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/ico/apple-touch-icon-precomposed-20200819.png","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/ico/apple-touch-icon-precomposed-20200819.png HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ba92dbb5-02d7-443f-8481-b67e4427328b/de-ch.json","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ba92dbb5-02d7-443f-8481-b67e4427328b/de-ch.json HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\ncf-ray: 9d89b40148508be6-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\ncontent-encoding: gzip\r\netag: 0x8DE21E3071BF00B\r\nexpires: Sun, 08 Mar 2026 12:46:28 GMT\r\nlast-modified: Wed, 12 Nov 2025 12:00:09 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: accept-encoding\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding, X-OneTrust-IsBot\r\ncontent-md5: ZosgxeTgvUyNnCLyNVyJcg==\r\ncross-origin-resource-policy: cross-origin, cross-origin\r\nx-content-type-options: nosniff\r\nx-onetrust-isbot: false\r\nx-ms-blob-type: BlockBlob\r\nx-ms-lease-status: unlocked\r\nx-ms-request-id: 5edfc21a-b01e-003c-4282-a92751000000\r\nx-ms-version: 2009-09-19\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58221,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1d76c2380b2b55893c15190b7cfc981e","sha1":"9368b2f6fa5461d192ceb794d132d09482c9e814","sha256":"5c51e58df695dd64ebd243b1ff20ed1f84f7afe3db4b6c1723ffb407393627c4","sha512":"770f315c21c3fb2195b1fe98124bae764c319f6f466e6462a72f7be92bd0c77753f342ddf1a004dbcbf4bddea234c1654b1cfcf5adb04d33cdeb27d06af99529","ssdeep":"768:fY/00yIwOYW6qQfvqQuX4z8VZEEhDjM3AycJlBv8hvkP6CuFQbJYmUwuJLgrbbty:fc0amHtfwnhXsSlBv8hvkyCImUrJLKXC","tlshash":"d1435c17289924bd4b8b53602079bf87f73c5656f2c9882dd79ccd3240935f62abb24b","first_seen":"2025-11-22T17:56:35.147623Z","last_seen":"2026-08-10T12:28:55.918526Z","times_seen":28,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/logos/d8f340ef-178f-4257-9ea8-01744cfc5459/182f96bb-6fd6-41f6-bfd2-2807f1757dae/039a2007-c2e0-4340-8d2c-4e6f23342858/OneTrust_SwissPass_logo_mobile.png","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /logos/d8f340ef-178f-4257-9ea8-01744cfc5459/182f96bb-6fd6-41f6-bfd2-2807f1757dae/039a2007-c2e0-4340-8d2c-4e6f23342858/OneTrust_SwissPass_logo_mobile.png HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 1962\r\ncf-ray: 9d89b402d8d55ebd-OSL\r\ncontent-md5: zV4bfgG4WycWxZPXBvPm8g==\r\nlast-modified: Wed, 03 Mar 2021 11:26:34 GMT\r\netag: 0x8D8DE3733F257B1\r\nx-ms-request-id: 679927d0-801e-003f-1a1f-f32456000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1962,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 50, 8-bit colormap, non-interlaced","md5":"cd5e1b7e01b85b2716c593d706f3e6f2","sha1":"d9e647da2b1c1f440f2513fd699159f74b5bf6d5","sha256":"e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6","sha512":"7e193862fe01d9fbf3aeea175c22685661e42851936b84c506144024fba277b61d258f8efde943744f2f90c2ce0cfeb710e538451b2160cfd85a4eb13386ef68","ssdeep":"","tlshash":"6841cb6691685c652e976c8ec6e598edf71e0e930e87210e0373b8996f7035c1142b9f","first_seen":"2023-06-07T23:36:04Z","last_seen":"2026-03-07T22:25:55.105664Z","times_seen":1186,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/logos/static/ot_guard_logo.svg","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.273Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /logos/static/ot_guard_logo.svg HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: tXyZydHjxQshFMbbBT1/8A==\r\nlast-modified: Sun, 01 Mar 2026 11:27:12 GMT\r\nx-ms-request-id: 556ee4c9-c01e-0077-3b82-a916cb000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\ncf-ray: 9d89b402e8568be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":497,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b57c99c9d1e3c50b2114c6db053d7ff0","sha1":"ada8abfed92ba8a545bbd9d299d74d5972cc4ae8","sha256":"691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19","sha512":"0dab6d06f386d922fb28f70f2590d4f9c361e7f4e5d5e581b98e59aac12b266cba596ffccd87203b4330673ee4ec1d459a1abdfc4b066d243a43b2bf7909f0ee","ssdeep":"","tlshash":"2ef0d4d91906a6adb6822e7cdd3c56e04c2c7ce274dc22c894cce094d4489bc9705855","first_seen":"2023-05-07T20:46:54Z","last_seen":"2026-08-19T05:42:03.222325Z","times_seen":181677,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/css/normal/app/sso.min-20200819.css","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/css/normal/app/sso.min-20200819.css HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/css\r\ncontent-length: 184031\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-2cedf\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":184031,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"3dd6fd96fa45e239df51fec88f94d90c","sha1":"1c12139a90f2e1c324eec36deecf6550c2a6dd7b","sha256":"df1e617507098c8826a05c6487106c27e13f067537dbaf4f44d0de4f7d5e8ee3","sha512":"e66771c22b6403e24c8a4ac519cc6b5875f3e72c904de493662c007ca696ff068ab405c46812c8f634025520cb5d471b795ce1f33d79be07412f273be10814cd","ssdeep":"768:K5ptYJ7mvjNiYXayvATzcGxwRv5FSN0k4PSw2w+Zw2w+6ZkynBCb1c9FnUShWlwF:K/uJqHXayvAPFwXu5NL6tw41","tlshash":"0604a8d6eae214ad372bc41fa4c16776173b9011fa572fb6f2d7946c8b883860223f45","first_seen":"2023-11-21T05:20:58Z","last_seen":"2026-03-07T22:25:55.103797Z","times_seen":371,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/vendor/head/modernizr/modernizr-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/js/vendor/head/modernizr/modernizr-20200819.js HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 7772\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-1e5c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7772,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (7466), with CRLF line terminators","md5":"1fa235981d7cbf5eb6098a7523afc383","sha1":"b764fad44ab2448d9924c2b0cf73ccee7b768c16","sha256":"7a9fa521a58ee93001981f3a7db498c589233d8cc616e8d09af0119388a865bc","sha512":"6df81d5e6524a92df4288e1a3309bb28c671e4711723a61c625f76f65981893599889d5647f295ab99737b6e9a3f263ddd02e32d3cf78d92ec89c2ffa21c7d9c","ssdeep":"192:tH4uMlSHW5nMIMzaGuX81KQob1dHYPeIny6RX:BHMgHW5MvzaGuX81KQoZRY5y65","tlshash":"80f1b88d7162b266479b5177507f870ef27898aaa9184440f09cc9bcbe74cb8437bf2d","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.107693Z","times_seen":604,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\ncf-ray: 9d89b3ff0c198be6-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\ncontent-encoding: gzip\r\netag: 0x8DE21E306B149A4\r\nexpires: Sun, 08 Mar 2026 12:46:27 GMT\r\nlast-modified: Wed, 12 Nov 2025 12:00:08 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding, X-OneTrust-IsBot\r\ncontent-md5: V9lppKU+HyMl4fcBMrSdNw==\r\ncross-origin-resource-policy: cross-origin, cross-origin\r\nx-content-type-options: nosniff\r\nx-onetrust-isbot: false\r\nx-ms-blob-type: BlockBlob\r\nx-ms-lease-status: unlocked\r\nx-ms-request-id: ffb8cb60-001e-0103-032f-acd6d8000000\r\nx-ms-version: 2009-09-19\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4977,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f35bc5ec31f1006c410170754ef87fa0","sha1":"dd70614007c132ca0a83ef599e66a23d7c6887cf","sha256":"c94147853ef58847ee45fadb73c4861f0a01c86c8401522297c588d3101c9ec8","sha512":"52fd5e51a150ed75114d1a3cf13cdf9af899c4b89ada893984dd74955cb7f40b9771b3d9322ee9d800054130045f9925c74d13d167d07c106f9090eb1dd634ac","ssdeep":"96:Opyc40wyB0/Dv+OimCVKxYa6Ay+vCPCjhjgjEjFZPbO2GWPz8Qm:zmQDmOimT6v+vdBo0CDQm","tlshash":"78a1432eb60c503dc79983d8d42dbe098fed693312c57814d84f4c6c1a6bbb32869627","first_seen":"2025-11-22T17:56:35.151943Z","last_seen":"2026-03-07T22:25:55.104833Z","times_seen":6,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":21,"dns":1,"connect":1,"send":0,"wait":85,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/202510.2.0/assets/otFlat.json","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /scripttemplates/202510.2.0/assets/otFlat.json HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: application/json\r\ncontent-length: 3145\r\ncf-ray: 9d89b401eb3e8be6-OSL\r\ncontent-encoding: gzip\r\ncontent-md5: 9lE+2pNt17NprNYQnKidvA==\r\nlast-modified: Fri, 21 Nov 2025 06:40:37 GMT\r\netag: 0x8DE28C8E1B312DA\r\nx-ms-request-id: 54526605-301e-0062-0d2f-acd452000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15345,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a5898ee8b5c59336dc3586e1612b963a","sha1":"52865e87ce29c41523fc31b64cc4a9991777a45f","sha256":"1e05381160d3bc508aae36ca5a6f0ade2d359ebd1f3d2a051b7c6de6b151bba7","sha512":"1657317e9239fd86ebfdd4d91faf3a7afff321bb5a9c602f4d5804e1ec291873eb3316bb40867a873a7c39697561c8bbb62e517c834340a6488255af9525e27f","ssdeep":"384:KeD0cGDjbn42OhOT85csXf1NFyNUV/OoH6iAHyPtJJAR:KeDia/i","tlshash":"376276523e104b29e1ebcb991883b5d835327d8bfd33a8dd924da3b842ed2f50d26745","first_seen":"2025-05-25T04:56:23.337501Z","last_seen":"2026-08-19T05:23:23.423657Z","times_seen":18926,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/202510.2.0/assets/otCommonStyles.css","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /scripttemplates/202510.2.0/assets/otCommonStyles.css HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: text/css\r\ncontent-encoding: gzip\r\ncontent-md5: 7mg/9H9DfjiTrxo8zBRCGQ==\r\nlast-modified: Fri, 21 Nov 2025 06:40:48 GMT\r\nx-ms-request-id: becdb456-901e-004d-2814-ae5568000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\ncf-ray: 9d89b401eb578be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26749,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (26749), with no line terminators","md5":"ee683ff47f437e3893af1a3ccc144219","sha1":"60f136e71bedab7236d29eaec3613c18faf1efa8","sha256":"9cbbf255dacf255e833c05b160728d890148725f0fc68b81f80a933cb876a81b","sha512":"48298751a213be27f7c7041cd8e964315edb369d65e3e2cd33f64541e002f203f093ac5f546a0e362fbe30afa8c26321826a8dea19546c3612b827c3f28448c4","ssdeep":"384:348ChRGI09YUNHDouelC774jlIhHLnwGfg4xqsQ4PNE:vYypWN","tlshash":"06c2459b38512b1ae6d7c719992139817d11aceffd739ceee009a3784adc3e24c1464a","first_seen":"2025-11-05T01:38:18.203767Z","last_seen":"2026-08-19T02:38:49.864926Z","times_seen":3875,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/.within.website/x/cmd/anubis/api/pass-challenge?id=019cc855-b7ca-79e6-8bd8-badea96d58a5\u0026response=009599e09d9ed2cc5edf3ac88b82d958500c93ff505bbf11ff35a757a8afeea3\u0026nonce=51\u0026redir=https%3A%2F%2Fch-login-swisssp.serv00.net%2F\u0026elapsedTime=169","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T12:46:27.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /.within.website/x/cmd/anubis/api/pass-challenge?id=019cc855-b7ca-79e6-8bd8-badea96d58a5\u0026response=009599e09d9ed2cc5edf3ac88b82d958500c93ff505bbf11ff35a757a8afeea3\u0026nonce=51\u0026redir=https%3A%2F%2Fch-login-swisssp.serv00.net%2F\u0026elapsedTime=169 HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 59\r\nlocation: https://ch-login-swisssp.serv00.net/\r\nset-cookie: anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; Path=/; Expires=Sat, 14 Mar 2026 12:46:27 GMT; SameSite=Lax\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27180,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-19T05:44:58.080893Z","times_seen":17968608,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/fonts/icomoon/icomoon.woff2?7m5yri","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/fonts/icomoon/icomoon.woff2?7m5yri HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/resources/css/normal/app/sso.min-20200819.css\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/idp/co-branding?resource=co-branding\u0026lang=de\u0026provider=","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /idp/co-branding?resource=co-branding\u0026lang=de\u0026provider= HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/202510.2.0/otBannerSdk.js","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /scripttemplates/202510.2.0/otBannerSdk.js HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 126783\r\ncf-ray: 9d89b400ae375ebd-OSL\r\ncontent-encoding: gzip\r\ncontent-md5: ONvHB8r9DWLCEg97H59YDg==\r\nlast-modified: Fri, 21 Nov 2025 06:40:44 GMT\r\netag: 0x8DE28C8E5F0189D\r\nx-ms-request-id: bf23895f-701e-00ed-5136-8b9a0e000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nage: 16723\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":524879,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"a2c3fe34db4c7fb1c4451892bae1e4a0","sha1":"0488250e210aa49c5abeedad334c8107dccc0f48","sha256":"7c549dad313b677b15cb870dc18f00ddc3a7aa549f53aa09dfdacd5db4d9e2da","sha512":"d9663383e52face86d43fcd4075cadb66e73819c3d8060a48c72daa58af2caa5702aa680da47639a71c705e4dab6327954aa147bc299748881fbfa71474f58a3","ssdeep":"6144:gh1WDttuwivNGSwMxnpNE7q2q20+bcVw1culi/rQVa1jdpSb1zHhE/beC:guuBNGS7xnpNE7q2V+QVaYtYbN","tlshash":"81b42a4e7590753587eb92b8c027414aba35746cac85806cb45cc5f90bf9f821ea3fbb","first_seen":"2025-11-05T01:38:18.209816Z","last_seen":"2026-08-19T02:38:49.846129Z","times_seen":3951,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T12:46:27.272Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.3.26\r\nset-cookie: PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"OneTrust","description":"OneTrust is a cloud-based data privacy management compliance platform.","website":"https://www.onetrust.com","common_platform_enumeration":"","icon":"OneTrust.svg","categories":["Cookie compliance"]}],"data":{"size":27180,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"2cc3f867544c5c09d2f0e98b65329841","sha1":"34703d74dcdd5c78ec2ffeaa3cbca699a6a8c04b","sha256":"c383d295c268bafc1f5c774912d90a4bc003b01c07c0e5da83e20e3ba2a85f39","sha512":"4cefed19101f235b43e317703330f86c3448cf37ec9081bba725dec55ca4907a23ec6bf0e2e672c307ee7ba62cdb0df01b71ea8baf70039e07c65ad0f25908d2","ssdeep":"384:6rbxC9z+jL+LnRV+emnRnEt06e/rK1Bxf/gnM:ctwUanRV+emnRnY9ejKbNgM","tlshash":"26c2b61154f71426206760ee6bfb6f156eb0c203c485cc187aee8b944f95e93da53bac","first_seen":"2023-11-24T18:19:37Z","last_seen":"2026-03-07T22:25:55.111353Z","times_seen":206,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/otSDKStub.js","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /scripttemplates/otSDKStub.js HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 8694\r\ncf-ray: 9d89b3fdae3c5ebd-OSL\r\ncontent-encoding: gzip\r\ncontent-md5: obJk4xP/fYkFcpWKSqgpJw==\r\nlast-modified: Sun, 01 Mar 2026 11:27:10 GMT\r\netag: 0x8DE77857ACD4C9B\r\nx-ms-request-id: 92052e0b-101e-009b-2c0d-aa1eb2000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nvary: accept-encoding\r\nage: 22985\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26546,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26545)","md5":"573b916dffd563ab46c74d368270a3aa","sha1":"40003565dcf647758cad0b4891f197597f6be9a4","sha256":"15a5a919d4b2c63b74bac3c0752f7faa08675d5ecaab478032a0232013a2ba6a","sha512":"c49eda7b535bc0aac36eb1c6f508095fd704061e5a1014b276b0832d9b7a8b3d83b91cbdf3e24bdef82472871dbd7ec6f830193c0f52111cb201a217acb2d448","ssdeep":"384:F58KNPpfxrLWMABwX/XmSH6rCZ2rt8ekDKlCmXCcpLKZ5Q8eFKJx6yzGq:bdxfxvlABwXvmQZ2rtGOCs9CWq","tlshash":"79c2d88db540ee3446d361ed9a3be25ab23a746d3489d068b894dce0247cc4f6533bb6","first_seen":"2026-02-23T05:11:33.48285Z","last_seen":"2026-08-18T15:03:44.649112Z","times_seen":13697,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":13,"dns":1,"connect":1,"send":0,"wait":21,"receive":1,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/primefaces/jquery/jquery-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/primefaces/jquery/jquery-20200819.js HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 97368\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-17c58\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97368,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32060), with CRLF line terminators","md5":"b6c9978c306ef264158551c140a4c475","sha1":"a8316d0f66cc97376d60ae86a47c7efb3b8134ac","sha256":"2b2485b0669a2f73c4846e82eb5a37421358591a8ac8ba21d8149bfb88adcbfb","sha512":"0f69c70c3e54bf7f7fa24eecfd86d07a7b868016c55abb889a0c4a0bee3081fb60098f0f1bd8ba905b6cbb30b50af6c9dbfed70863baece4be2b54bd977d966a","ssdeep":"1536:rYE1JVoiB9JqZdXXe2pD3PgoIK6alrUSTJuFk/zkZ4HWLZoHsrOa99fwkKb7/HpU:q4KZ+23WLZICOaLfwkK7qD1Paca98Hr/","tlshash":"d893e8d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.109308Z","times_seen":541,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/vendor/vendor.min-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/js/vendor/vendor.min-20200819.js HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 182041\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-2c719\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":182041,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (663), with CRLF line terminators","md5":"c8ae9313d64c63be74208ff6564a9c83","sha1":"2d76425f12d558c47f76e9602665b7001c51630a","sha256":"f5e694ba6b63a657fae3f561dc0e8ae0247534616d9e844005d11d8ba2535338","sha512":"3f262f556fc794d8e779c2f43d8a6fb8468ea1e79e0369aa58399bf41c5806d0badb0ad69d15f7c021bf256b8b6a74a316d5808e5db4ee01c6840fb1f4a353e5","ssdeep":"1536:pSgDCs3fXCLcMpW+3moWgWngVaSBNdAj8Seh8C0rjLOYnQkTWqBC367JIAYQtokX:pSV3moWJ3pWOrsUk367JIpSi33n1O","tlshash":"d304288d7562313142bf21a6107f110b72379fbeb4058558b868c9d86ebec45227bf7e","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.107182Z","times_seen":473,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/img/favicon.ico?v=20140709-1126","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/img/favicon.ico?v=20140709-1126 HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1150\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-47e\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"6d866d9c4568bf7fc03e597e74ce7e28","sha1":"e1b3d9f0e9cdcb785a94b6c1e1fe651a4ff98dcb","sha256":"7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677","sha512":"7dc58e58fc991e2c9310e22a6761aaa398586082c13fd7863fcadd48e15cef8ed7337dc33d0acc0d0b9b698d4d26abbbe6995fa48d2c9ce1161b2f39fea2a381","ssdeep":"","tlshash":"53215d85ffcbd895e413ed317a81e1862c584d61eab09d8130a1f4ebeb716744c54778","first_seen":"2023-05-05T11:25:27Z","last_seen":"2026-08-10T12:28:55.912536Z","times_seen":2772,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Roman.woff2","fqdn":"cdn.app.sbb.ch","domain":"sbb.ch","tld":"ch"},"ip":{"addr":"51.102.173.7","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.app.sbb.ch","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Mon, 16 Jun 2025 00:00:00 GMT","end":"Tue, 14 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"64:03:D9:B1:DF:64:D1:96:90:7E:AB:B9:46:62:45:8C:4F:9C:66:25","sha256":"D6:59:15:8E:AC:85:78:EE:86:77:55:A8:16:F3:3F:8E:79:B8:4A:20:AB:F9:C8:B6:A7:69:8B:8E:33:92:F8:9E"}}},"request":{"raw":"GET /fonts/v1_6_subset/SBBWeb-Roman.woff2 HTTP/1.1\r\nHost: cdn.app.sbb.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: application/font-woff2\r\ncontent-length: 14152\r\nserver: nginx/1.29.5\r\nlast-modified: Fri, 27 Jun 2025 13:56:18 GMT\r\nvary: Accept-Encoding\r\netag: \"685ea302-3748\"\r\nexpires: Sun, 07 Mar 2027 12:46:28 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With\r\ncache-control: max-age=31536000, public, private\r\naccept-ranges: bytes\r\nset-cookie: 9527f1a32486d650b0687919ffd41c2b=20c2b1d1e09af7508bb98a8360b4b6aa; path=/; HttpOnly; Secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14152,"size_decoded":0,"mime_type":"application/font-woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14152, version 1.0","md5":"82e55d1865d40988204fa60522628f4b","sha1":"e9d74fb23204a62c520d19b8fae3f0193539cdfb","sha256":"966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997","sha512":"560f0dd619c0d077e763bda61e5d75317eb77bece73ef7fee4b47952fc42efa6e04e2bde8b1a578850dbe11f6cf5c1e9843751cd58708b9b23d3c5f1ffe05689","ssdeep":"384:RsNCc7msIdEuqeDGlzVcxs3K+voFVbmzjBl7STQMxap/CVJ3sCFhwvtG:giskEuqe8Vcx+K+QFUPB0TQMkRCT3sCT","tlshash":"4f52d18f9cb3257be1c27774b9b37ad87adf669e3143c28883273bd9458101136688e1","first_seen":"2023-04-05T17:56:10Z","last_seen":"2026-07-29T19:39:26.311604Z","times_seen":1348,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/img/logo_text_de-20200819.svg","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/img/logo_text_de-20200819.svg HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 139971\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-222c3\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139971,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"512410d9227bb0c2481e175dce0eda72","sha1":"1deb5d9f09592101e632a8351865d54b1d6a27f7","sha256":"c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07","sha512":"855feb227bb9448de654bf5c616a2dbf71c4f97550a00a30372cb0ae2f7b0bd70b7a4430d84c8386934b7064d8bc3f66e926b5b2dd9920812af96c3469743a86","ssdeep":"1536:mYtjakc0aZDT/Zs4sC0jfjR1YG+s2Ltt99ac0eW53zzVCoYs2rhrXzgEA6SJB5LQ:j5E2tvYkUv1","tlshash":"37d3a716436884e8b59f45f13cd41d0a2a5a98e723125919faae8c31dff3ef3d382b45","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-08-02T13:00:46.656753Z","times_seen":2255,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/img/login_bg.jpg","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/img/login_bg.jpg HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/fonts/icomoon/icomoon.woff?7m5yri","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/fonts/icomoon/icomoon.woff?7m5yri HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/resources/css/normal/app/sso.min-20200819.css\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/img/logo-20200819.svg","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/img/logo-20200819.svg HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 7374\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-1cce\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7374,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"795242580bfa3135028bd0750fdc1654","sha1":"2c344b6662e62ddbdba49f635e1c33a827fe75d4","sha256":"deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909","sha512":"09cf57ea5f0fc9778dce5578718e2b2db960d145bec1afce58b6ba0b1670ff4e31b91b3cb69eab0004e72e193b4d0f374a13f5c8d96a79902a96f5c72a65054d","ssdeep":"192:1w1xe9KNd07c0Zsg2/ZX0dRzVO0Zfv4emqb9Z+siAtz6oyQg/S:uc9y07/Zsge0dRzzZYebb9Z+sh9yQp","tlshash":"25e198f5aa1c96bc24579a58cf32d664670fa0fe73aa83f24c1ed7b06443d94d943c28","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-07-15T10:37:23.109703Z","times_seen":2376,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/scripttemplates/202510.2.0/assets/v2/otPcTab.json","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /scripttemplates/202510.2.0/assets/v2/otPcTab.json HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: application/json\r\ncontent-length: 13885\r\ncf-ray: 9d89b401eb508be6-OSL\r\ncontent-encoding: gzip\r\ncontent-md5: bWz5sx25NoHgadqiEJOepQ==\r\nlast-modified: Fri, 21 Nov 2025 06:40:40 GMT\r\netag: 0x8DE28C8E32F5530\r\nx-ms-request-id: 1e7b1a0e-501e-00b5-2b14-ae9e75000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nvary: accept-encoding\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68617,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b4754e53f9614a34a0b326e9f85954e5","sha1":"00af2c94a1ad02d85d145b030db59d8c2bb8ce45","sha256":"255d095e1ffdc048a732481381219d3e2a8d3d64ab9fb16074215666adb02cdf","sha512":"b68d76735ea97201e22daad2795f99102c514a237cefc84da8b9241e85405ee7109e51d46d08877be8f20164ff4e981b237509ce48b1d24f06b634e247420e92","ssdeep":"384:ydMOpYA02vw93aR8HdcS1q+KOq+7svm6mApZgNGmchl5MsgoFfGisq3lNvcjnh3/:upYAm3rc8Th7svpZXx2q3fOdVPOT85xv","tlshash":"1863d89b3aa1530afee38b1deb926de97124c81fbc335dedf1420678868d3e18d51509","first_seen":"2025-11-10T14:28:06.253239Z","last_seen":"2026-08-18T20:23:40.608783Z","times_seen":996,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2","fqdn":"cdn.app.sbb.ch","domain":"sbb.ch","tld":"ch"},"ip":{"addr":"51.102.173.7","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.app.sbb.ch","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Mon, 16 Jun 2025 00:00:00 GMT","end":"Tue, 14 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"64:03:D9:B1:DF:64:D1:96:90:7E:AB:B9:46:62:45:8C:4F:9C:66:25","sha256":"D6:59:15:8E:AC:85:78:EE:86:77:55:A8:16:F3:3F:8E:79:B8:4A:20:AB:F9:C8:B6:A7:69:8B:8E:33:92:F8:9E"}}},"request":{"raw":"GET /fonts/v1_6_subset/SBBWeb-Light.woff2 HTTP/1.1\r\nHost: cdn.app.sbb.ch\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/font-woff2\r\ncontent-length: 14212\r\nserver: nginx/1.29.5\r\nlast-modified: Fri, 27 Jun 2025 13:56:18 GMT\r\nvary: Accept-Encoding\r\netag: \"685ea302-3784\"\r\nexpires: Sun, 07 Mar 2027 12:46:27 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With\r\ncache-control: max-age=31536000, public, private\r\naccept-ranges: bytes\r\nset-cookie: 9527f1a32486d650b0687919ffd41c2b=16be587fd40b4637a8f3adfd636052bb; path=/; HttpOnly; Secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14212,"size_decoded":0,"mime_type":"application/font-woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14212, version 1.0","md5":"8b70a44a98a0ac5d721df7d8f5136f7b","sha1":"10e10c01e732f3d35a78e1051bfcc9fe2589ddda","sha256":"5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf","sha512":"65833d65ef11617a6d2d2a9c2ed81fc7079368da6f9569b56404fa5a66d878088d95c5632b216d0e6c7f3e40aea6a6d7df5b9c0147743ecc06f38e95508397f2","ssdeep":"384:5bJ1keL4/s04W4gUz+/1x55hsno5oky9RAl51Gx:ZasaD/V5hsnDVyC","tlshash":"a652d017c934adb9c708cc34b49e35b2cc2e9ad444a2382c57c7a1b9370a9d36e54e4d","first_seen":"2023-04-05T05:09:02Z","last_seen":"2026-08-02T13:00:46.661936Z","times_seen":2633,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":134,"dns":9,"connect":21,"send":0,"wait":24,"receive":21,"ssl":100},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/.within.website/x/cmd/anubis/static/img/happy.webp?cacheBuster=1.25.0","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:26.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /.within.website/x/cmd/anubis/static/img/happy.webp?cacheBuster=1.25.0 HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:26 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9814\r\nlast-modified: Wed, 04 Mar 2026 17:54:26 GMT\r\netag: \"69a871d2-2656\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9814,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"25381fdc040c3cb2fcdc7c71cdb570b6","sha1":"796fda9d4fdedb56103b2a7195a5b0a02ba2a5a7","sha256":"cf61e5c06edd82b23e22ecc47e57c647413489cdc3e8f87e827a7b67cf89a9ff","sha512":"0fd3c8247b3fc8b8b0e23421a3347e3cb827c037cbe5bb003b62b4978cdb2677e032dedce73bd5651fbe8faa5f8c30bf2cc5692c3da66f2e03906127d484589b","ssdeep":"192:qVGww2vFA+R7SUj6mvAGdudn+UT7RCmSMw9lGunBeMLm7yiCYgz:qUINAS7ZNvAgut1Iww9lGu0MLoI","tlshash":"07129e9042dda335d688cdb042e90feb57a4306a4459ab7e8310c2bbeff75e385404e6","first_seen":"2026-03-05T17:26:40.672841Z","last_seen":"2026-07-25T08:11:58.046355Z","times_seen":22,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.cookielaw.org/logos/static/powered_by_logo.svg","fqdn":"cdn.cookielaw.org","domain":"cookielaw.org","tld":"org"},"ip":{"addr":"104.18.86.42","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:28.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cookielaw.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:42:10 GMT","end":"Sun, 26 Apr 2026 22:42:08 GMT"},"fingerprint":{"sha1":"82:0B:BC:A4:CE:93:24:87:52:6C:08:AD:37:93:1C:13:3F:2C:83:E4","sha256":"92:AA:15:B4:3C:46:BE:A7:9B:5E:E9:08:8C:5D:DE:0D:75:F9:1E:C8:38:A2:B2:1F:20:64:DB:CA:0F:29:53:80"}}},"request":{"raw":"GET /logos/static/powered_by_logo.svg HTTP/1.1\r\nHost: cdn.cookielaw.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:28 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: Y+c301RBZNK39PvKQWrIBw==\r\nlast-modified: Sun, 01 Mar 2026 11:27:13 GMT\r\nx-ms-request-id: b5313007-201e-007d-491f-aa0f42000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\nage: 15169\r\ncache-control: max-age=86400\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: cross-origin\r\nserver: cloudflare\r\ncf-ray: 9d89b402d8e65ebd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5194,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"63e737d3544164d2b7f4fbca416ac807","sha1":"030370aa38715e4c41589633f69d0bfe8255d46c","sha256":"5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d","sha512":"31ee1bb536c0e50f5568a415ea3308367bfcfd11d2a6f7dff1c8e3a982f7be790c240a603cd4c6e187672824b8e5d07646049a28c6a88a7b001eb9a0142f312b","ssdeep":"96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV","tlshash":"93b1a9f5aa45d29c391e8984ce37a964551fb4eb7bfe83d06192d332e40ede0f900c18","first_seen":"2023-05-04T19:47:29Z","last_seen":"2026-08-19T05:23:23.424823Z","times_seen":121422,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/img/loader-20200819.png","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.434Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/img/loader-20200819.png HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: image/png\r\ncontent-length: 272\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-110\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":272,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 24 x 24, 4-bit colormap, non-interlaced","md5":"1a7ca896940219da5393e26600e0ee7b","sha1":"558e1d3bad16b2faa7527f1f3133e21bf89cd507","sha256":"f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5","sha512":"29b51656a862e758fab0bad8b5cd18d68ed7f57a6fdd42b188d85dd1705234ed9956b15276baaa031d6f20d5049317d86bd13752aea03739183b9461b8d33863","ssdeep":"","tlshash":"a4d097c3c8be5c2aad60423393ca88278a232da010043243be36f829c73212889302d1","first_seen":"2023-05-09T01:15:49Z","last_seen":"2026-08-02T13:00:46.659383Z","times_seen":1752,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/js/swisspass.min-20200819.js","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/js/swisspass.min-20200819.js HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 99344\r\nlast-modified: Tue, 19 Dec 2023 16:40:26 GMT\r\netag: \"6581c77a-18410\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":99344,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a8deceea0458745a7c0f562c65e01e27","sha1":"850c4796889f9173e30e016916155941cab3ae31","sha256":"9c50211b34ab0377f3b35c243c98e402315127bfa5b51e147cb22c702174ca60","sha512":"17d7d5daaa8e1c864fe21ce96782f33b45a907820a659e34ce760dad6d62895e92270d4073387ed5d563447c0f952e9369bf37aaa323b7b80912df3b5df13f9f","ssdeep":"1536:gj5taENXUembGTAC/gLf8XPpzaaGNZIMcSPAZAcSH5bVRLbErz:s5taE9FLTWIPpzaaQIMvPAZrSH1bErz","tlshash":"38a3da0d705234b72bff30f7147f620591336499b8454c40b26d9ca61ebaa4e53afeae","first_seen":"2023-11-18T18:24:47Z","last_seen":"2026-03-07T22:25:55.09795Z","times_seen":551,"resource_available":true,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"assets.adobedtm.com/15ff638fdec4/7a0c4d63ddff/launch-6cc731e967aa.min.js","fqdn":"assets.adobedtm.com","domain":"adobedtm.com","tld":"com"},"ip":{"addr":"96.6.17.25","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"assets.adobedtm.com","organization":"Adobe Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 24 Jun 2025 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"2F:BD:F6:81:46:EE:C6:68:47:14:7F:F0:63:9A:CA:DE:F6:5D:C7:80","sha256":"F0:43:20:D8:ED:30:30:7B:92:0C:29:1B:07:12:29:EE:72:B4:10:4C:38:64:3C:9A:AD:BF:70:A4:DC:CE:5B:8E"}}},"request":{"raw":"GET /15ff638fdec4/7a0c4d63ddff/launch-6cc731e967aa.min.js HTTP/1.1\r\nHost: assets.adobedtm.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: application/x-javascript\r\netag: \"db5d6811a1b0edbeaf0efd5259dba9a6:1756213500.532307\"\r\nlast-modified: Tue, 26 Aug 2025 13:05:00 GMT\r\nserver: AkamaiNetStorage\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=3600\r\nexpires: Sat, 07 Mar 2026 13:46:27 GMT\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-length: 38564\r\naccess-control-allow-origin: https://ch-login-swisssp.serv00.net\r\nx-content-type-options: nosniff\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":130651,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (32756)","md5":"db5d6811a1b0edbeaf0efd5259dba9a6","sha1":"a79d8b1a06b1d2259851adfba3571be632423fe5","sha256":"465405fb9724046f8c3c0f83ba4d5c58592e663b6e3a73fb8e661ad790ff97fa","sha512":"87f59e02a8a42b8ad814f2d2fbdbe784738adfcf4248afc459d859cf88b930623d614e30f90315b595b595c8ab5cdca20669b1065aa2b55e755ee708ebf04c62","ssdeep":"3072:NQmN8LbsM/ESbPbKPbKK6jHKlVz0riUNKeu8yVgJbx7PXV5UCmglQ:NQmN8LbsM/ESbPbKPbKK6jHKlVz0riUs","tlshash":"3ed32bccb2d5b41503eb3279961f200fb27e6a84685d8010eea6edd47d7a60e5373e6c","first_seen":"2025-08-27T17:30:53.00956Z","last_seen":"2026-08-10T12:28:55.915747Z","times_seen":83,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":57,"dns":52,"connect":1,"send":0,"wait":3,"receive":2,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/resources/fonts/icomoon/icomoon.ttf?7m5yri","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /resources/fonts/icomoon/icomoon.ttf?7m5yri HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/resources/css/normal/app/sso.min-20200819.css\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5; anp-anubis-auth=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhY3Rpb24iOiJDSEFMTEVOR0UiLCJjaGFsbGVuZ2UiOiIwMTljYzg1NS1iN2NhLTc5ZTYtOGJkOC1iYWRlYTk2ZDU4YTUiLCJleHAiOjE3NzM0OTIzODcsImlhdCI6MTc3Mjg4NzU4NywibWV0aG9kIjoiZmFzdCIsIm5iZiI6MTc3Mjg4NzUyNywicG9saWN5UnVsZSI6ImFjOTgwZjQ5YzRkMzVmYWIiLCJyZXN0cmljdGlvbiI6ImRhOWFkZDU5MmQ3ZWI5Y2NhNzcwNWNiNDg3MGQ3ZmQ0ZTk3MThjY2Q1MTQ4NmM0MjYxYTcyN2E4ZDU2Njk2MGQifQ.DIuIN0g3Ixzu0h6_gOUMeSYGckJ78LZ4_RvkEmkkJ97FWf4tl5LDnmC7pHTLhl8lPsPNLvxDi3E4ke2lsmvPDQ; PHPSESSID=3d99af58686cc5ab0fcf1c826ca52376\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 2646\r\netag: \"670bc640-a56\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2646,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"84698fd4264469ff0859d76862ce1cb1","sha1":"8feb6a1a566b263bbef880975322b6f53adfc372","sha256":"9aacf6c58fd5f5ca4b412278e5dc978e33852274d2a1b0aa592b007d02811fa0","sha512":"a8fd1fd53cfff582cd7fd0b2ebd137552bcf526e50c1d6c026f47305eb41dd8cdfaddfd06c14f2f5f76bcdce7a12f556201e6d0fb19609a10514bb9ce5bbe6d9","ssdeep":"","tlshash":"715184278aa3821a7042c0e47be3a75277168287d10ecdac7a5da1c9cf805f4c5b328c","first_seen":"2024-10-17T15:09:21.74968Z","last_seen":"2026-07-21T12:53:18.44289Z","times_seen":61,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"geolocation.onetrust.com/cookieconsentpub/v1/geo/location","fqdn":"geolocation.onetrust.com","domain":"onetrust.com","tld":"com"},"ip":{"addr":"104.18.32.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:27.831Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"geolocation.onetrust.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 21:15:30 GMT","end":"Sun, 26 Apr 2026 22:15:28 GMT"},"fingerprint":{"sha1":"F5:DF:B2:C0:09:B1:11:9B:DB:B4:9B:F8:5D:90:ED:37:FA:1B:CC:B6","sha256":"B9:75:F0:95:C8:7F:CD:61:C6:1E:80:44:33:6D:64:D3:02:CF:9C:AB:37:88:EC:00:F5:01:55:88:23:BD:0B:52"}}},"request":{"raw":"GET /cookieconsentpub/v1/geo/location HTTP/1.1\r\nHost: geolocation.onetrust.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://ch-login-swisssp.serv00.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 12:46:27 GMT\r\ncontent-type: application/json\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: GET, OPTIONS\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nserver: cloudflare\r\ncf-ray: 9d89b4003be4783d-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8d896eded71ee5fc863cf1ec1485da75","sha1":"b36c99cd02aa88e94a55b028381d9c5cb61cbbef","sha256":"3dddf5b1f3c0e76d359e7fe585b61f721980981a612e17d7ebfedfc3e6fc3b3d","sha512":"a216a2ec987ed8aa509d4bf88075844374819f15767190c2f9fc1b7dc05436cb33ac0fa3466bd207bd3104e455cd3c72fb8622dd0759ab64f197ac216850382e","ssdeep":"","tlshash":"3da0025864599d1d9dfd824a530e726a1244a309828751c6c6c9ed75c5812c9b05c480","first_seen":"2025-06-02T14:25:58.002399Z","last_seen":"2026-08-19T05:42:03.152969Z","times_seen":169081,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":15,"dns":1,"connect":1,"send":0,"wait":47,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ch-login-swisssp.serv00.net/.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=1.25.0","fqdn":"ch-login-swisssp.serv00.net","domain":"serv00.net","tld":"net"},"ip":{"addr":"128.204.223.42","port":443,"asn":57367,"as":"Atman Sp. z o.o.","country":"Poland","country_code":"PL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ch-login-swisssp.serv00.net/","date":"2026-03-07T12:46:26.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.serv00.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Feb 2026 11:23:50 GMT","end":"Wed, 20 May 2026 11:23:49 GMT"},"fingerprint":{"sha1":"72:13:31:70:A0:8A:CC:4F:41:F0:F6:42:3F:0E:0F:3E:0B:F1:93:CF","sha256":"56:96:04:79:04:5C:7D:4D:1D:29:88:E9:64:BE:17:D1:98:D4:40:C6:11:8B:17:95:F3:5F:BE:E2:78:55:A8:B0"}}},"request":{"raw":"GET /.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=1.25.0 HTTP/1.1\r\nHost: ch-login-swisssp.serv00.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ch-login-swisssp.serv00.net/\r\nCookie: anp-anubis-cookie-verification=019cc855-b7ca-79e6-8bd8-badea96d58a5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 12:46:26 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11324\r\nlast-modified: Wed, 04 Mar 2026 17:54:29 GMT\r\netag: \"69a871d5-2c3c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11324,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"41d0a0b35ecb280c4d6558ab996c37e2","sha1":"d39b882bfa5133e5c915b554daf8da612dffaecc","sha256":"34253f00628fb569fbcb9b6237114896e1727200500504831dcabdb3579bf1b0","sha512":"ad807b810d5413b4f3d06971ba1217726978d7e7b45403564f41d6bab2181416e502ad9f0ba7fb5efa7dbef1801bdafb2ec0e62d77bec8f348de36244be81518","ssdeep":"192:OVGww2vnppFEw77nCPCy5eS0YKBTnTlWkdBKWfhl0LsKbSZ/hvk+dNqfYTFa:OUInFEw77naCy5eDBNXdBK0hW72k+vTo","tlshash":"ff32ae3ab7bd0326e940bb78c4ec9e19886e184d57748bb2c644b07825b1dd2fa115bc","first_seen":"2026-03-05T17:26:40.670166Z","last_seen":"2026-07-25T08:11:58.041157Z","times_seen":28,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-07","alert":"Sinkholed","trigger":"ch-login-swisssp.serv00.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}}]}