{"report_id":"34a97998-392a-4767-89ad-26eb77364371","version":6,"status":"done","tags":["orange","telecom","phishing"],"date":"2026-03-16T12:16:06Z","url":{"schema":"http","addr":"smtp.romtelecom.net","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":0,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"smtp.romtelecom.net/","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"title":"Webmail Login","dom":{"size":3663,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"566fbd6ed3ffbaceda6bf2321e936325","sha1":"7e39c619ae7ec09d7672a1b03438fad401032960","sha256":"5915304324fc6ff7752b6ab6a5fe8a7d296f00e842aaeecce9bd7592e83e5745","sha512":"1a94daa47befde4b5343aa794a261afadd8c73f42eb6942c7f074fa3a3416313abdd939e1d9b5af698bf6b45d4f784daf341340845bce2f7dbfff1e84f07a3fd","ssdeep":"","tlshash":"f271730058f45d26a02310fe7da1f019bdf0d207d515a988b9ed4ed81fc2d9a9b3ba1c","dom_hash":"domhash0d54d98e627940c4487041fb06bc1909","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"smtp.romtelecom.net","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":0,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-20T12:16:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]},"summary":[{"fqdn":"code.jquery.com","ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-03-15T23:03:26.25948Z","alert_count":0,"request_count":1,"received_data":96376,"sent_data":428,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"smtp.romtelecom.net","ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"domain_registered":"1998-11-03","domain_rank":0,"first_seen":"2015-02-26T20:51:37Z","last_seen":"2025-08-04T16:14:46.418817Z","alert_count":32,"request_count":12,"received_data":677748,"sent_data":6195,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/jquery.cookie.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e3faa7fc49484964ecae46ca9494f35","sha1":"bfe7d4d0c3bfb70871cab51bd8f462ca78a38ad3","sha256":"13161f845883ddc67c4adec84919b2350c3ab125c5c4263dbb736594c54ccd71","sha512":"ada7522bfc15892bed3e1dc79657dbda90c8eee16773d43ded4f6b6df6df16458e56b7733b13786c1130d85d76285e3b1849429609e766dbf2875f143fb6b376","ssdeep":"","tlshash":"c5517694b7cc365e06ab22412a6f40ace63cfe73155844dd8c1965e82ca0c3ad76bd6b","size":3095,"data":"","first_seen":"2023-03-07T01:42:12Z","last_seen":"2026-07-24T16:56:22.92378Z","times_seen":3636,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"eventHandler","is_inline":false,"md5":"11a14410ceda908891eb4923b9873ef2","sha1":"f7ef531f57eeeff81671f28910b93b40a8bb62a2","sha256":"7fa0643f559175b8e027c7ed9a91bec853ca77b467ec716d58e9f0c665259f53","sha512":"f5e0f4238d7e9f2d53f1f12e594c1102930718c5a2b06848fa90cc776a98f8bb7b546d548adc8f453e8bd41ece438fbeda81da7474057e71fc5bc02faff9834c","ssdeep":"","tlshash":"9b400000000300f000c0000c030000003000000003300003000000000000000033000c","size":7,"data":"","first_seen":"2023-04-19T15:34:27Z","last_seen":"2026-06-14T13:35:03.355523Z","times_seen":2469,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"47fe7d5f03afc5cdcb7a2243068ef8d4","sha1":"4ee63046093f25b950b66127de121eb94b3a62ed","sha256":"89bd2ae3e8f4affb5990a84bd8c3759c39e919edc5903c1bff6a4b4b38a89c89","sha512":"135e69c60dd01937ba9b04680f9bae5e001357e675e493ada80c8325e5fba3c0a35c3b3115685e7888c216be2afddcd717a7087af81cebc365526799dbb21a4b","ssdeep":"","tlshash":"5cd0a918a1a02362433760f99a1aa202a4b0521b604a6f023c8ee4c92f8e834836c768","size":286,"data":"","first_seen":"2025-12-21T21:41:13.287331Z","last_seen":"2026-04-12T01:16:09.194656Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/jquery-ui.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec9758d9508e2fd22ddbdc6d5a28f214","sha1":"0ed7df6cc32be8f9687cda3cd6e109e5de44339e","sha256":"ba0103f765802f299bc7dca5c35d9a00359a0abb10cac136f43caf9c0bf98b7c","sha512":"eb1c05921adc80474acf15d80c04344236031d6de5f05a36c0d03663fba22da3ae31cf07bba7f3b048d3ca9154d3e995202378ce8defb83a294a2ad3f06d6ad4","ssdeep":"6144:HH8aL8lYTUdtP5u5R5x56BHHWi/Jn3qnj9Pj3iEXPW6l/plqEp4lH8aciVAbsuBD:PTStP5u5R5x56Bnj/Jn3Ej9Pjg5y","tlshash":"2994a689f39c266a867a325d5c2e02cd723c8076d601587fbc5d59dc29d883c42bbfb9","size":435844,"data":"","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-07-24T17:23:09.120329Z","times_seen":6781,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/login.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"938584cf46ba44fb063862c5e7dd0274","sha1":"7d7800e127c49c6ca50d9afc0b17830c109df5fa","sha256":"1bca68baf98dcccd3da4292ed3ddc510c20025235db4483b790e9cfa6ee1d70e","sha512":"bd77004cd9cdad4237cc32554d97ee5ba63eff521acf4640f2f6d4f97b0bd762e3ddd1bd56c6f6a29bd4bc3f5bdb2c49c072594211f3b4c9610a688851ca9ad9","ssdeep":"","tlshash":"e131ef5c30d758726b636479233f8149b4a81803200ee999f96cc7d5af90d229ff14eb","size":1858,"data":"","first_seen":"2025-12-21T21:41:13.282192Z","last_seen":"2026-06-14T13:35:03.341561Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/site.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"e70efdb1c6a4af7be9564c781df71c55","sha1":"c9858480baf28278b8b1e291717079a823adba83","sha256":"9e4534854fd3d11d9cf6a99f864381d5e5d24fea6465deba496c000795af5534","sha512":"89f1e02fe05c646164b76586563bff7d7f0ff9113cf8c93bd8247850b76e384ac2c2bd2431f8edb295fe33fbbcf8503d39d7e13ae86d391a4c4b9286d32a8aa7","ssdeep":"","tlshash":"4c517da878a328621663a4300a9f554c39be091b255bd950fe1c92d15fb0d3cd6bfaf8","size":2473,"data":"","first_seen":"2025-12-21T21:41:13.284274Z","last_seen":"2026-06-14T13:35:03.342599Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-latest.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8101d596b2b8fa35fe3a634ea342d7c3","sha1":"d6c1f41972de07b09bfa63d2e50f9ab41ec372bd","sha256":"540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441","sha512":"9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb","ssdeep":"1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB","tlshash":"b293c8d9b6d27162977730b850bf510bb13a98eab80c4c60f1a4d8e47d78e89507bf2d","size":95786,"data":"","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-07-24T19:30:51.154026Z","times_seen":55114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"c0c00e77ade75e05416254c036de96fb","sha1":"f5f3750a9a0a375d0bcf8d754ee077f8cf157af0","sha256":"1a27e86bd33ca2dc28dd2aee1673d20b54212fe110223933f3e0e095602266d6","sha512":"5d8200bcc671d36fbde9db9d25a533f2608e4d1b72bb0fc91b0d85df8906dd0f930924885670e79c51a54ae791e0df8e42820fa4cf02d2a58da5dca426944e67","ssdeep":"","tlshash":"6af0c22968b9b138903b64792e9ea6c4aa715003181aaf08bf2c67805f46559ad72f98","size":469,"data":"","first_seen":"2025-12-21T21:41:13.289751Z","last_seen":"2026-04-12T01:16:09.197121Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"smtp.romtelecom.net/css/jquery-ui.css","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /css/jquery-ui.css HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"7caa-641d2a653229e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 31914\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31914,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1339)","md5":"6e1d340977674163ddd0486f552a1274","sha1":"08139d326fb8fb0c36e63b322e18df6d7ea1b1ff","sha256":"1a905c8be901f780fa0b9022103ce0bfabfaad97cc569a26c53191317b50ddc3","sha512":"7b39769fd5ab863d20619e1de84c5d7f806d55a75dd7ce1bd6dafe1671fa431852ee7c61239417e6cace1229cc1cff42bc095f9cc6d32c7a4661fe36bab0069c","ssdeep":"192:N1St0YpyiTMN1r0sNJdBYUPXMfe3zYZQY+w+da5Y6BjSmMErEURHQm54OVqv9i6V:lYpyiThORzk1yet5LV1zS25Sfp","tlshash":"3fe2bb316b433909ba1bd1a065911bf3e33e1342fd6b6d3e64aa259cd3d94e080bf5b4","first_seen":"2023-06-10T02:42:47Z","last_seen":"2026-06-14T13:35:03.350796Z","times_seen":2362,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/css/bootstrap-responsive.css","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /css/bootstrap-responsive.css HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"5576-641d2a653229e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 21878\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":21878,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"5b6c9ccd31e4603ce05c688ea46fef8f","sha1":"b666108fe68a439a484cdea868c426c1eb79efc9","sha256":"9a2d15bec955a21777f761f667578a407eb2385e6a130bc0c614d45ba9c0add8","sha512":"be1ee7d45ae202a232e67cf1a4f2ddcfa31c39afeac24d8cb467198e4b2f004a815b24516e89dcf82ef2f70c6e786f49e31c58883ad9c6445665ab8a57abc0c7","ssdeep":"384:XDi+XnHtUrZKt+uSmu+c30s8SGCxGfGYb/0EUN0QT0FeVF5aFLc:TiOnHtUrZKtqOI0jSGCxGfGYb/0Ery0e","tlshash":"2da2b19a2ee21044ba72f1b91efd03047682a813d3bfed5339de51a8cf456495ca7e84","first_seen":"2023-06-10T02:42:47Z","last_seen":"2026-06-14T13:35:03.35171Z","times_seen":2358,"resource_available":false,"data":null}},"time_used":349,"timings":{"blocked":116,"dns":1,"connect":54,"send":0,"wait":54,"receive":54,"ssl":67},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/css/main.css","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /css/main.css HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 14:18:57 GMT\r\nETag: \"39ce-641d41d193dee\"\r\nAccept-Ranges: bytes\r\nContent-Length: 14798\r\nMinion: beonline-mr-buc2\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":14798,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"8d02e50cc88d7a122347c55c594250a2","sha1":"56328284eae3400e7cb21d94c49b5db9d4db918d","sha256":"ede123c5644a96d0d892f3351746426433387c9233c3c31a05eeaabb70042f76","sha512":"c90538c790fdb5ac3e91ecd08dd33f1b5c5939f4edcc5d59a7bb6497ce224cc948af900e0811a530ec4dbac8b7588a38d3ac6ed94f172f82c2040696db78e1fb","ssdeep":"192:LjzFFCjP6KtfQsArQwiz8NsicR5sSaNrfHaRZje6TeKDeuRE0L6r14wUtUEARJ1c:RFCS8Swe4eMeuR5QR0QW","tlshash":"2862506795530c0ab813c9686ff95e4222748503920ed6ab3ede72acff575d880b17b8","first_seen":"2025-12-21T21:41:13.278944Z","last_seen":"2026-06-14T13:35:03.347933Z","times_seen":6,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":119,"dns":0,"connect":58,"send":0,"wait":56,"receive":55,"ssl":67},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-latest.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-latest.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-1762a\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Mon, 16 Mar 2026 12:15:45 GMT\r\nage: 793620\r\nx-served-by: cache-lga21983-LGA, cache-hel1410032-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 55, 19933\r\nx-timer: S1773663346.636849,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 33202\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95786,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32086)","md5":"8101d596b2b8fa35fe3a634ea342d7c3","sha1":"d6c1f41972de07b09bfa63d2e50f9ab41ec372bd","sha256":"540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441","sha512":"9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb","ssdeep":"1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB","tlshash":"b293c8d9b6d27162977730b850bf510bb13a98eab80c4c60f1a4d8e47d78e89507bf2d","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-07-24T19:30:51.154026Z","times_seen":55114,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":29,"dns":0,"connect":13,"send":0,"wait":15,"receive":5,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/login.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.602Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /js/login.js HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"742-641d2a65341de\"\r\nAccept-Ranges: bytes\r\nContent-Length: 1858\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1858,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"938584cf46ba44fb063862c5e7dd0274","sha1":"7d7800e127c49c6ca50d9afc0b17830c109df5fa","sha256":"1bca68baf98dcccd3da4292ed3ddc510c20025235db4483b790e9cfa6ee1d70e","sha512":"bd77004cd9cdad4237cc32554d97ee5ba63eff521acf4640f2f6d4f97b0bd762e3ddd1bd56c6f6a29bd4bc3f5bdb2c49c072594211f3b4c9610a688851ca9ad9","ssdeep":"","tlshash":"e131ef5c30d758726b636479233f8149b4a81803200ee999f96cc7d5af90d229ff14eb","first_seen":"2025-12-21T21:41:13.282192Z","last_seen":"2026-06-14T13:35:03.341561Z","times_seen":6,"resource_available":true,"data":null}},"time_used":297,"timings":{"blocked":116,"dns":1,"connect":56,"send":0,"wait":54,"receive":0,"ssl":65},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/jquery-ui.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /js/jquery-ui.js HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"6a684-641d2a65341de\"\r\nAccept-Ranges: bytes\r\nContent-Length: 435844\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=98\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":435844,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (840)","md5":"ec9758d9508e2fd22ddbdc6d5a28f214","sha1":"0ed7df6cc32be8f9687cda3cd6e109e5de44339e","sha256":"ba0103f765802f299bc7dca5c35d9a00359a0abb10cac136f43caf9c0bf98b7c","sha512":"eb1c05921adc80474acf15d80c04344236031d6de5f05a36c0d03663fba22da3ae31cf07bba7f3b048d3ca9154d3e995202378ce8defb83a294a2ad3f06d6ad4","ssdeep":"6144:HH8aL8lYTUdtP5u5R5x56BHHWi/Jn3qnj9Pj3iEXPW6l/plqEp4lH8aciVAbsuBD:PTStP5u5R5x56Bnj/Jn3Ej9Pjg5y","tlshash":"2994a689f39c266a867a325d5c2e02cd723c8076d601587fbc5d59dc29d883c42bbfb9","first_seen":"2023-03-07T01:02:10Z","last_seen":"2026-07-24T17:23:09.120329Z","times_seen":6781,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":103,"dns":0,"connect":0,"send":0,"wait":59,"receive":187,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/jquery.cookie.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /js/jquery.cookie.js HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"c17-641d2a65341de\"\r\nAccept-Ranges: bytes\r\nContent-Length: 3095\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=99\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3095,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"1e3faa7fc49484964ecae46ca9494f35","sha1":"bfe7d4d0c3bfb70871cab51bd8f462ca78a38ad3","sha256":"13161f845883ddc67c4adec84919b2350c3ab125c5c4263dbb736594c54ccd71","sha512":"ada7522bfc15892bed3e1dc79657dbda90c8eee16773d43ded4f6b6df6df16458e56b7733b13786c1130d85d76285e3b1849429609e766dbf2875f143fb6b376","ssdeep":"","tlshash":"c5517694b7cc365e06ab22412a6f40ace63cfe73155844dd8c1965e82ca0c3ad76bd6b","first_seen":"2023-03-07T01:42:12Z","last_seen":"2026-07-24T16:56:22.92378Z","times_seen":3636,"resource_available":true,"data":null}},"time_used":222,"timings":{"blocked":167,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-16T12:15:45.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; path=/\nclient_mail_preferat=Roundcube; expires=Wed, 15 Apr 2026 12:15:45 GMT; Max-Age=2592000\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":3749,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"f7c8f72ddfe4bfaaccfc4246bd4be7e1","sha1":"4cccc16cb635c15f1afbcebc1387ec466294505f","sha256":"d80574c397aeca10cdb1eb0f80b81cbd1a6ac15c271becf89e9f1aee83d44349","sha512":"8f2c16a783f7f2aac5a6564a4dff6113ab438d42bca048b4c2d6c359f1fddc2b6f007050e66b9ceecbe99fc089dd7d04e66fe4a37aee6d0d5dc499fcb62a994b","ssdeep":"","tlshash":"cd71750018f45d36a05310fe6ea1f0197df0a203d615a98879fd4ad81fc2dc99f3ba58","first_seen":"2026-03-16T11:45:35.519284Z","last_seen":"2026-06-14T13:35:03.345777Z","times_seen":5,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":130,"dns":1,"connect":59,"send":0,"wait":60,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/css/bootstrap.css","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /css/bootstrap.css HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 14:18:57 GMT\r\nETag: \"20b9a-641d41d193dee\"\r\nAccept-Ranges: bytes\r\nContent-Length: 134042\r\nMinion: beonline-mr-buc2\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":134042,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"7aea0d8f16e50065651db183ba506d77","sha1":"2337b169e9f7ce2afc202e551d27847fbd74c977","sha256":"dcf01f36cde83b3dcab69dd2e3e4c9301af4d52f111b2121917713b85e908112","sha512":"51fc5567dda1e66eeee794252ca672f7a2ca5dddc9313eeb380d61f755a6e257a66a80c63ded5b67d48afefe4a1d1cf691e8524358ad2fa44de665b972242cda","ssdeep":"3072:bUPs8C3MLZgEeeIJY6xFla4a1Wkz4CFszL39W:bUk8C3MLZgEeeIJY6xFla4a1Wkz4CFsU","tlshash":"44d373e2aaa12904712bc19c66d1de82776d4083850fcd7e72fe31acff499c84573e99","first_seen":"2023-06-10T02:42:47Z","last_seen":"2026-06-14T13:35:03.346804Z","times_seen":2358,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":107,"dns":1,"connect":51,"send":0,"wait":55,"receive":155,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/js/site.js","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /js/site.js HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 14:18:57 GMT\r\nETag: \"9a9-641d41d195d2e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 2473\r\nMinion: beonline-mr-buc2\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2473,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"e70efdb1c6a4af7be9564c781df71c55","sha1":"c9858480baf28278b8b1e291717079a823adba83","sha256":"9e4534854fd3d11d9cf6a99f864381d5e5d24fea6465deba496c000795af5534","sha512":"89f1e02fe05c646164b76586563bff7d7f0ff9113cf8c93bd8247850b76e384ac2c2bd2431f8edb295fe33fbbcf8503d39d7e13ae86d391a4c4b9286d32a8aa7","ssdeep":"","tlshash":"4c517da878a328621663a4300a9f554c39be091b255bd950fe1c92d15fb0d3cd6bfaf8","first_seen":"2025-12-21T21:41:13.284274Z","last_seen":"2026-06-14T13:35:03.342599Z","times_seen":6,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":117,"dns":1,"connect":60,"send":0,"wait":57,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/images/title_webmail.png","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /images/title_webmail.png HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"6b8-641d2a6533a0e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 1720\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1720,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 60, 8-bit/color RGBA, non-interlaced","md5":"bc1729a4ae2e941eb33bf605940fb411","sha1":"f0eb3031a4d690f380283650666edd5c7fbca16e","sha256":"0cb4dc7c3efedde0ac66c697590426ccc113aaff124b6f311e340a27cdb5357c","sha512":"2d4f9e881671ae0bc99b870c329463b1ad880c4e02c38daa3aa01a9b16e3c608144856d93d240d7dafc0c635d5dd730fae12c76d67b1b6f95fc39ce6d2846d12","ssdeep":"","tlshash":"41311af0da808662cea58ce3114a3572e23008f72a739107a15c388729b497ce0b47e1","first_seen":"2023-06-10T02:42:47Z","last_seen":"2026-06-14T13:35:03.348896Z","times_seen":2357,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":346,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/images/sigla.png","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:45.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /images/sigla.png HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:45 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 14:18:57 GMT\r\nETag: \"4268-641d41d19555e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 17000\r\nMinion: beonline-mr-buc2\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17000,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 69, 8-bit/color RGBA, non-interlaced","md5":"4e138316b8393b0fb17303a4321767ee","sha1":"2824442d30f206f9b9422540b40e2878d20298de","sha256":"1a66cec89c3bf617808fcffff4ec4d2601dd1f8aab7c04c8f6443da63e48a5c0","sha512":"31e7548d8db2d29d8553e8621cb20580772b2f8668ecd57063718809a63fbe35c1bca16f88987db5150c253b55863710e505c3324cfb6a82c8bbc54e22919e41","ssdeep":"96:akEWRuxNXrNjNoFNQnxYqcV21d0usgiL/qaKcH:akt05B2GxsXy4","tlshash":"ac72b579fdf079795509e7322de434816c335b03aac0ac4dba9d4c2a6f107a99c0f256","first_seen":"2023-06-10T02:42:47Z","last_seen":"2026-07-12T14:16:28.274504Z","times_seen":2372,"resource_available":false,"data":null}},"time_used":400,"timings":{"blocked":347,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"smtp.romtelecom.net/images/favicon.ico","fqdn":"smtp.romtelecom.net","domain":"romtelecom.net","tld":"net"},"ip":{"addr":"92.82.184.5","port":443,"asn":8953,"as":"Orange Romania S.A.","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://smtp.romtelecom.net/","date":"2026-03-16T12:15:46.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"smtp.romtelecom.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 06 Mar 2026 00:48:21 GMT","end":"Thu, 04 Jun 2026 00:48:20 GMT"},"fingerprint":{"sha1":"0B:64:B3:3B:16:23:A3:01:66:08:4C:DE:A0:80:DD:B5:29:91:6F:52","sha256":"CC:4B:40:6D:47:96:17:AB:CF:20:8D:A5:28:E0:28:85:8E:70:6E:98:1B:65:26:7D:A6:F8:90:BB:38:9E:B6:5C"}}},"request":{"raw":"GET /images/favicon.ico HTTP/1.1\r\nHost: smtp.romtelecom.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://smtp.romtelecom.net/\r\nCookie: PHPSESSID=31g3dv8cmohdncgrqppanv2lfs; client_mail_preferat=Roundcube\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 16 Mar 2026 12:15:46 GMT\r\nServer: Apache\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nLast-Modified: Thu, 23 Oct 2025 12:34:09 GMT\r\nETag: \"10be-641d2a6533a0e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 4286\r\nMinion: beonline-mr-buc1\r\nX-Robots-Tag: noindex, nofollow\r\nKeep-Alive: timeout=15, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/vnd.microsoft.icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"31f92fd3fa554a79503f4268296cc583","sha1":"38d2f537a29694b5ff76d5d306192e0834f4e76f","sha256":"d07b4b7080cfea73ef7d1a843fa64d1eb50da15b09b0c2d5cf1c4bc74473c2d0","sha512":"8beae73cc03ee7fc5f2b278573b095378f39069eca358658ef153f30192816007dbee12165b61bafaaaae20a9d0209e9f14648473a062dec522201d6a33a65ca","ssdeep":"6:sfylT0jjkaXrba6dCCCCCCCCCCCCCCCCCCCQdILVGLVGLVGFROCtarkaXrjjjjjE:suvsvvFd+22SMIsUt","tlshash":"e291847aeaa3460cf0603834c1a953060552ac6ca9ae418f0c7cbc2cbb3c4c3381fa8c","first_seen":"2023-05-27T09:54:59Z","last_seen":"2026-07-13T08:37:17.125155Z","times_seen":2461,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"smtp.romtelecom.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Orange","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Orange phishing","tags":["orange","telecom","phishing"],"meta":null}]}}]}