{"report_id":"ad963eb3-3e7d-4b8c-bb3c-c027efde9a5b","version":0,"status":"done","tags":[],"date":"2026-07-17T19:20:31Z","url":{"schema":"http","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":0,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"final":{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"title":"PUBG MOBILE EVENT","dom":{"size":138965,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (909)","md5":"073ed2f1ae461fca97d2473a61cf4879","sha1":"fc9b2da583aa7ed385d40abbcce3748d5f914ab5","sha256":"62649fc3cc4cd83aa0b60e2bfab2c91e7fbcc6f6d32c4ca450056b61e1159ce5","sha512":"19642e1e509f680f7bc34114f1792e1463bd5b1416efcd520982f22b64739ce50308efaebe8e7ff90d55c279f1c94c3fd1da961f9f10094e67490ad6595dbc81","ssdeep":"3072:TthtcKDp9sSjFo4GIUmz7ecORaftEthY1ZSn4tIjSaUyAiGUpFWjW2w561nPmboU:TthtcKDp9sSjFo4GIUmz7ecORaftEthV","tlshash":"68d31a632114381ad00f91e9fab5db5a712d4a53e30f095af2f8d68ce7cae854d33a4d","dom_hash":"domhash4f1bc054740511cf1ff38253d257d400","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":0,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T19:20:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.pubgmobile.com","ip":{"addr":"95.101.10.40","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2017-10-18","domain_rank":76737,"first_seen":"2018-04-27T11:06:13Z","last_seen":"2026-07-17T06:26:03.395399Z","alert_count":0,"request_count":1,"received_data":406589,"sent_data":568,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-07-13T08:23:46.111996Z","alert_count":0,"request_count":3,"received_data":264085,"sent_data":1494,"comment":"","tags":null,"fingerprints":null},{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-07-13T10:01:52.556352Z","alert_count":0,"request_count":1,"received_data":31920,"sent_data":541,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":25583,"sent_data":542,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-07-12T22:42:14.264548Z","alert_count":0,"request_count":4,"received_data":397842,"sent_data":2276,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"mail.itsmebay.rumahsakit.de","ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":304,"request_count":76,"received_data":3789209,"sent_data":39662,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}]},{"fqdn":"im.g-o.lol","ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-19","domain_rank":0,"first_seen":"2026-05-04T02:25:48.209274Z","last_seen":"2026-07-10T08:53:08.038564Z","alert_count":0,"request_count":17,"received_data":1060552,"sent_data":10202,"comment":"","tags":null,"fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"site-assets.fontawesome.com","ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-10-18","domain_rank":380600,"first_seen":"2022-02-10T06:20:21Z","last_seen":"2026-07-16T16:37:44.136235Z","alert_count":0,"request_count":1,"received_data":544,"sent_data":536,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-07-12T23:52:49.76326Z","alert_count":0,"request_count":1,"received_data":93748,"sent_data":478,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"0e0845c3751143b4cf09461f3fe629b2","sha1":"cd1e7922a61ce7193d14ca3dc9c925d75ead7a96","sha256":"3ea0025e0b71b367968d34f22739dfab24fd73405bb595e9de468ad8fa408efb","sha512":"18532ea16c4928d0a4652670e85fa30fb75171526c4936fe0a4719a31a2d22cbd25c34c90bd1653a45bcc0d1f9541ffc6dba3b7d76bb71979ddbe2b47ce23349","ssdeep":"","tlshash":"dab0120043fd7234264510c09315ba08dcfe8a32d11c51108a1f39e84d82b0c50f7364","size":97,"data":"","first_seen":"2026-06-09T03:21:52.047252Z","last_seen":"2026-07-17T19:20:40.735484Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"70122a44586a685ccdbfef50fbc920f6","sha1":"5c1a853dd1ad80821a05a55d379a19da8ee457a8","sha256":"6e5011825e0728a99d1de0e991a1087ed4086f25a3ed1e510725c6071f4157ba","sha512":"bd4db6a72990b5cbf5d8dec25cd7eb0127f43c8f48fec67cb727124467d036d28200708463db389021723a756cb22943e8eb6190b75a775d4b2f1e6e21ad52b4","ssdeep":"96:IrzWgaz2wIZJo8WK6KxJlMz2ALAzABUDmtANMW2JSy9+W:eaz2PZJofK6KxJlK2ALaIUqt8y9+W","tlshash":"48b1ad46b2ea2c42542bb87717bf000c39ac5607a005df05bc1c9ad86f25f756db7a9e","size":5267,"data":"","first_seen":"2026-07-10T08:53:16.093242Z","last_seen":"2026-07-17T19:20:40.736008Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e5395f7146df1aea6cbd4a15c63b6d5","sha1":"6fe48cab7381db9f8f15f372dfc6e971409ef77e","sha256":"e5f217be6ea2a5ce4cf29b9021e4538b6f2e19bfb14a65d914219f252559da37","sha512":"affe9fe1c65d9743aa5efcfe55975c8377ec46d37b28ccf671f72fbf91ed7ff47b6abb8dd5ae830662ec7e1913cec6576d98a206cdfebf7ecde96900285b990f","ssdeep":"","tlshash":"8731d3933a44047891eb986e53bd9204be7c840bda41ee48fc3c62855fb4d5714e97df","size":1546,"data":"","first_seen":"2026-07-10T08:53:16.094708Z","last_seen":"2026-07-17T19:20:40.73647Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"b113c65a19f36fb5a9266a496c1189af","sha1":"95aab4311d7c5b422a5cd7495d9ba43bf329dbcb","sha256":"efe7161ef1113910e69fe70331f2850157dbd9f35f6dcee0c81cdc16512ddab1","sha512":"86136c99dcad33abc7338eb806371e451aafb7a7ec3b35666f313b0488fde84be774db11552d0dd8cf1199233d5e3949dcfbcfa5ebf4af860ed900a3496f456e","ssdeep":"","tlshash":"f5f08b0dba54293d49e364382d5ac9013ce80d008f04bac4f8f860538e70e2536ecaf5","size":560,"data":"","first_seen":"2026-07-10T08:53:16.096157Z","last_seen":"2026-07-17T19:20:40.737003Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"0a104ece1afc967bbe41f80dec5b7d49","sha1":"918c7493423a088cc69cbea3c9be63f64debf979","sha256":"997ed2fd57839e7147097193ac322748e9db720d45a2cfd22b5e3928ceffc9a9","sha512":"9341ed862c20c13223c57fb2c268cbc20e3a763b5f1fa41e506f2fe7871fd6aec812b6473526ee32625a1dd9e122d13a6678732ea218fdfc05a82a15707d889a","ssdeep":"","tlshash":"94f02b1caa64286c49e7a0382d9aea0138f50d008f94aa85fcf450539ab0e6025edae9","size":576,"data":"","first_seen":"2026-07-10T08:53:16.097566Z","last_seen":"2026-07-17T19:20:40.737801Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"10d5e378917079cb144d20db86761905","sha1":"1344ab84656f0a7850024f5d3145030ff01953ae","sha256":"49df5b87477561e6b086ae5770bb1628f74f853d6cda0b36846bbbd0c0c776ed","sha512":"284216cfebf3629bc4266ea33216958ad04b234d76069d35a92e31325acd4c50df6cabe5a2d18efbf50de7660c0e92588130e07e53dee90c6826084544f20d3f","ssdeep":"","tlshash":"3df02b1ea764287c45f3a0387d6bc9013ce50c83ae54ab89f8f490538ab0d7425ec9ed","size":576,"data":"","first_seen":"2026-07-10T08:53:16.09896Z","last_seen":"2026-07-17T19:20:40.738286Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"e91b21ad5fbfa3010f691b7e321d6335","sha1":"babbff903c76f178cbc82dd5cf2b5b503f137019","sha256":"1eaac15b26fbe5f4b2634f8e832bc18a1516146c3bd46fc7ebe4236698a1a563","sha512":"d583bec6d427ef4fe08c4aa34073246a24d4c989c7ac9cbedac12727cb3b3ab494c29c4f1f88998bf040828175b2c630dc6d2a65280d5aa8cc27e59f17ef6322","ssdeep":"","tlshash":"ea41d260bb5d6fb959bb00f904ba4945cb280615b6008d52f83fa6cc2f0477cb7327ae","size":2263,"data":"","first_seen":"2026-07-17T12:50:50.451836Z","last_seen":"2026-07-17T19:20:40.738788Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"725d08f3c3f4f686c5179a56d5b98956","sha1":"e44195e8731f4f4ad61de340cb00a7331a18110f","sha256":"f9199ad4e38a8fe59f67e08b7f2d92c25b8de40bdd197b634ba448b2a6fef0a1","sha512":"c987eb20ac055ad617f4f5541ffead5b5cf16ac02e9d940eb9be882a2e411f0fdecf74febb3027161ef368e10805d5676b4fbd07e326fb8334d313d8c13186b9","ssdeep":"","tlshash":"b9116d45a60b9f482eb151f990f5dd7a1fa4498818839d18106e58c960e0fb97ffbc14","size":1043,"data":"","first_seen":"2026-07-10T08:53:16.101661Z","last_seen":"2026-07-17T19:20:40.739358Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"1e0039e4cf468cd094d8586a8173919e","sha1":"3a3c59d45c92e36cd9a5b4f877f391c77ef97633","sha256":"aff34b0a322a33d8fdccb20c14186756652176ef2d60564114209b7ecd2d6ac5","sha512":"dbdafd37845811204a0fe7f26f3145c149a8309378eef8b8714bfbbe676215193df35aba69b1ab4520ecf11ddfa0dee0330449d47d13b765327710ffca17bbd4","ssdeep":"","tlshash":"4211fc3921e8613ec7c6609e217ed7ac3e7c21522a07504091addd9dac10d5bd86fdbe","size":1074,"data":"","first_seen":"2024-02-22T16:27:47Z","last_seen":"2026-07-17T19:20:40.740367Z","times_seen":178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"a71d61da5c153d0fda6d3e4e89b8ed9d","sha1":"0b4ebce74bee5c8b9c9d77ffa1b9eb2c75a7fbcd","sha256":"0abbc91ae2f129fd4153e0966843a5b861803d62ddf7b444303fd39adc6c3c2a","sha512":"f6ab8bcce86a42c8c5ca1d3ccc153eb52776e68b3fd6d3a8353951da818ebb2433690fdf403b2c6204258ae47da885c6354961310062d2fa7599d5c74d48d399","ssdeep":"","tlshash":"a9e0486f65f7e522064f15e535df478c3430002b3683db09792c81564f61c15ac12cbd","size":385,"data":"","first_seen":"2026-07-16T16:37:54.483498Z","last_seen":"2026-07-17T19:20:40.740856Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/slide-header-zone.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"1946b2cd060c107e0364ea1a940b588e","sha1":"e8c74222814175adb8be8a3e6f021f2ff7d3b9f3","sha256":"0e01578d3c1377d90ed611cd992282819c3ad5ff9a0c435a9b765fbec084b27a","sha512":"aa1c3df265dfa85963edefa315057ae544e51cb5605c5098a2d6d5d47bd73eda35a6df714909eec95c5f69d6d56fd4d5247203fc16e840a1e51f1b4caf56892b","ssdeep":"","tlshash":"fdf0a00295ad3c14c1929428ef69cd0364e60902880ade84bcd8004f1fd4e55f1df7f8","size":465,"data":"","first_seen":"2024-09-25T03:40:49Z","last_seen":"2026-07-17T19:20:40.680839Z","times_seen":90,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/google.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"54c5eddc078f9f65112588c23f437a91","sha1":"114cf451addc7aee256f46817e300e293f4d508f","sha256":"90f1886566de647d909fd3ff13fc3a7690aeded832ccf0cbea6b14021bb51874","sha512":"547262bdad60407a599c732c4b79d05c2e3e91d2c443af1ed034555cf5916786b23ecc18ca8b2bdc371e0d2389f0d49b82eb56c210446cd4ff015a6cf9e01f7b","ssdeep":"96:Miv6Ye48stLy4LjLFLlJX4MAP11lOZL6xgSIIBKut8LYLWLsLfBPS5YgP65t9h5J:rdZ8ste4vJGPicCwqnW","tlshash":"e0c13a0ab1291e9f5972d6b621f64404bf7c182b45418f0cf9ac18c42fb1e49bab7dde","size":5865,"data":"","first_seen":"2026-01-02T16:23:08.558676Z","last_seen":"2026-07-17T19:20:40.713401Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"61f70b9eb2388834655c65d38ab8032f","sha1":"a7442b246d3f61a4c9eac8a422dc847663400c6e","sha256":"f18c055809fdccf3211aea0b90016849b47892fe5badd3315da3f663ee4811f8","sha512":"eac10f5b9a76827f508d0e65692509e2f9d7e207530def30a565c6bf80d2cf3669fef81aca867d847a039af36678a129e8a946954f3cc6260f23c4e849699500","ssdeep":"","tlshash":"cad0976708aa94384bc8004e20bbc3e97a5021e42f13360092deccda9a10d978963c9c","size":247,"data":"","first_seen":"2024-02-22T16:27:46Z","last_seen":"2026-07-17T19:20:40.74135Z","times_seen":228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84245,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T19:20:40.684114Z","times_seen":59524,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/scripts.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"60118d7019b032dd118a781698a7e2f7","sha1":"d20aed21b7eb6b93310be8e1de25f5d64fab4ed4","sha256":"a083a3f3a3a9805322185b9ecf9066c2aa3a38dfc683904ad5396b86d3cf4b7e","sha512":"8e908f3b94e6387bfd20fdac5513485264cd0dab7918d243aa3d520697534e05cd5d7d46423137a0a04c85d4070a056603e7266ad957196e21f240d15aa61c7c","ssdeep":"192:jak2ExGnwSaAWP/dlj3VM+lWiDFiSKWij7Jy1ihyTHvDfH2AuNGuKF:jakZxAbWHdlj3VMqWi5iSKWiXCiCPDfd","tlshash":"c312cc86b5d51c01a47b78b6123f11587a5c8447250acf09fca89aed2f21e27ad73bcf","size":9796,"data":"","first_seen":"2025-04-08T10:46:38.488917Z","last_seen":"2026-07-17T19:20:40.718825Z","times_seen":80,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-17T21:24:07.821752Z","times_seen":234102,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/slide-notif-zone.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"fe5f9cefd8cdeb7223204985d4fcff9b","sha1":"07290f0580629134fae84811d25cf7e4efc1429b","sha256":"0876d5efeb88bbb02434e56b729b0285c11cbedd3c5ab2b5b7b18a2f8d89d240","sha512":"4e03d07e6893ddc0d9dcc0c76707e139096d8d83f30b2511dce95f04b1f91ec31446ea2ac931bf8998ae3c9f91444cd515b176cfc1f9ba3bac0e7d0c518da395","ssdeep":"","tlshash":"08f08b0db664293d49e3a43c1e5ac90138e80d008e08bbc4f8f860578fb0e252aecaf5","size":572,"data":"","first_seen":"2024-02-22T16:27:46Z","last_seen":"2026-07-17T19:20:40.691684Z","times_seen":241,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"397754ba49e9e0cf4e7c190da78dda05","sha1":"ae49e56999d82802727455f0ba83b63acd90a22b","sha256":"c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4","sha512":"8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb","ssdeep":"1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe","tlshash":"8c932bdd72d2b03257ab30bd106f540ff2361959280d8850f268d8f9bc79a49a277f6d","size":92629,"data":"","first_seen":"2023-03-07T01:02:08Z","last_seen":"2026-07-17T20:09:26.384417Z","times_seen":71058,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","size":84320,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T20:56:53.502501Z","times_seen":15965,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/codeflag-link.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"5674ef5a95b8f48ba0a8405d056ba0ce","sha1":"9991445667304928434eb128a38ab05902c38391","sha256":"595f1377e816f8f8f50b3cc558c4cf3f4a83a20ac45675b3e558b6aed1d0d42a","sha512":"5a3a0916c466dab4209820c2270e23da544432c26af5d6c6baaea7ec1b5baac0cebbb764a1afb48aea2fe55d71ac9b32f1141e78d86ba6f4655d3c67cb7f60c6","ssdeep":"3072:CsJjxDkcrFNjeNkWGlXQlXaDiNQOdrZXCiu:C8xAcvyOxlXQlXuPFiu","tlshash":"5aa4f092d6216b16f750b63841a67d89298c59db8cbd7d8876ed9b8c0f2c0be4f7c10c","size":462811,"data":"","first_seen":"2023-10-14T05:17:14Z","last_seen":"2026-07-17T19:20:40.731067Z","times_seen":489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/link.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b5414224fc4b2f543b68e143c014e2f","sha1":"b46a2278d376e2f4859ef1d193d042063061479e","sha256":"c386f4fb12f4de0ed51142708ef2fd7018d075e0cc00331220fd1214018ed7a4","sha512":"8a01998af5a929720d6fd5391bbb59869941c9dc1aff7e052384d220f433b2dd3cc79b45b6ad466f01f8baa12f025c474b0dc6ce46cb0d7e1e2e1b91278060d2","ssdeep":"96:VnXEWiHRwiKLAN4LSz7btQtMrAEevdlFLeN4Lq73hUJeJAJKE+6rd:l0WiHRwiKsN4t2rrgaN4XQJJB6rd","tlshash":"40c178047a195881997797b6b0bb9440eb2d072f0a114f09fcbc29c86f70f16fa76d9e","size":5812,"data":"","first_seen":"2024-03-14T04:42:19Z","last_seen":"2026-07-17T19:20:40.684613Z","times_seen":80,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/senderv2.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"a331c1236fa6f0dd6c9f3f9e98df2e9a","sha1":"5121042afd07566cb65f1046310e6958972db704","sha256":"add7fa0bb5ecff1a86355cc79ac10ec188fc78981ac88911a590b6d53692f034","sha512":"86251be8d03f0ca5f409f7ed03854d31bbc5bd0f97f59fbc7790da1ab3c8911b120883926911afab8a85ba1d19f06ee1a9959a476c28fcf0ad2c42c9e8cbe463","ssdeep":"1536:uKQY+JGsQzbPOe28QUm+I8jKqmLSIPHchdaevC1sGlIC1q5Y:pbBan+IZLSIPHchdaevC1sGlIC1q5Y","tlshash":"669340c176c17c8603876b76371bb1e6e53f4c986184899af110fc90f4f9a22fae56b1","size":93345,"data":"","first_seen":"2024-02-22T16:27:46Z","last_seen":"2026-07-17T19:20:40.707586Z","times_seen":132,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/script1.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"e270af607dda93c863ad433b2eddcd91","sha1":"bf0d1dba2a4298c3293e4b3e820c81ae581890b2","sha256":"fc46a6567798a2fce34eba8fc0aaecc9b0818842e786acd4b7880f51cf5784b4","sha512":"2975bd918a9c170b226d23ee3742f7cfc96a3257a793ddd21fd422e130eb6136b8ada25db7d6b158a461bfceddea75b3a71fc3b4f6c8cf10a5d975129862b385","ssdeep":"192:e3FQCpC164YFhuj48+iif9v4xqY0D46Mwi5GwYF5WL4cSiI8KnxqQcb4/MZiPt:e3FoJYFJhiQgxqsaiMwYFx3iOnxqUuil","tlshash":"58328d48f35e1e956e3380ba117b50102b6d6c1b1906ce0cf86d28d86f91f6dfe7a94e","size":11584,"data":"","first_seen":"2024-04-05T06:22:58Z","last_seen":"2026-07-17T19:20:40.681497Z","times_seen":138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/kings.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"f8806242b756a742555827b5e549f8e0","sha1":"4f56f1a3cb590af2c9254d2e288b31dd2e5f9e17","sha256":"fce73f4de3039a1a90eed1c8cfa35a9fbda8d9b939d9b17131797d5a40cad5aa","sha512":"876af87c5309c38e6c9fd4444ec744611bd5bc759bd674ec649bc3faa114ce3742e277fda3f9a73cf8d698e0e7418a82804fa70332436aad5f7e477138dc15a3","ssdeep":"192:eV1HJaqJAAARANUbiNmzC3j32fIYlR+ZTURQE5P5Ksxgh85kebUP:eV1HJfWAARANUbiozC3j32fpRUU35FaF","tlshash":"b4f16a013dc4acea638bda56fa25f2d5f32e48d0f3905e2fd114e84364e53a2a5825bd","size":7535,"data":"","first_seen":"2026-07-10T08:53:16.047471Z","last_seen":"2026-07-17T19:20:40.667792Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93107,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T20:04:31.567013Z","times_seen":16543,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-17T21:41:22.724552Z","times_seen":725053,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/media/kinnon-popup.mp3","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.987Z","timestamp":1784316000987,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /media/kinnon-popup.mp3 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:12:44 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 30408\r\nContent-Range: bytes 0-30407/30408\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: audio/mpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":30408,"size_decoded":30701,"mime_type":"audio/mp4","magic":"ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio","md5":"b579257a752038eac3d06d2b12f9583c","sha1":"c7ff26c89d9a5c364f382839cc6c265bde0189f8","sha256":"6f4cb572f05e24fc4a4a6b1e8c0f008538eb5d158c4ac019f6a8e3d9c1f0d4c3","sha512":"f0bdfcc321506455a604c2f37a8249ee61c57d55b67fde74d95605e2f02f9ac3cbcc8877944feed11c98c863ee65daa472035b63b7385716a3f309f453b0cd25","ssdeep":"768:3/ULxHNbpl2XQtjToohr2CN9sIDUXxxvFHo1nfBKlG:PULZoXK8g2CN2IShFI1fgG","tlshash":"c1d2f1259ba02133f39c1ab5c25387041e252842069caab33775721af1ee9472e5b2fb","first_seen":"2024-01-05T16:39:53Z","last_seen":"2026-07-17T19:20:40.663998Z","times_seen":145,"resource_available":false,"data":null}},"time_used":1939,"timings":{"blocked":1667,"dns":0,"connect":0,"send":0,"wait":271,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/main.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.082Z","timestamp":1784315999082,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/main.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:16 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 359457\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":359457,"size_decoded":359701,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"9e86604af3d78cbc05aebd979386ec0b","sha1":"257b051f34988af153027496bae217a63e433fe3","sha256":"16ce972639eb7a325a53c30c32beb4338b12cc0b82c26913e95974e2508259b1","sha512":"776f6dc8735305f60be5865a629c1809bc3526b73df17945ee4334238f063ae637b3b5f9648530fa61dc4fa823f17a565945a5b348d41b69150d64bb82c353c0","ssdeep":"6144:LgqfEBlmM3LOesj9nC5N9fZ/rFZsUEmr7y:LgLBAEOMZ/bsUXq","tlshash":"06746cb56d8d6a9eb93b8e2fdb42183e6e1aa0fdb70140cf8c9d37e4c311154591acb4","first_seen":"2024-04-16T05:43:23Z","last_seen":"2026-07-17T19:20:40.664559Z","times_seen":126,"resource_available":false,"data":null}},"time_used":1621,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":1350,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-12_10-50-21-513%20%281%29.png?m=1783828643","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.492Z","timestamp":1784315999492,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-12_10-50-21-513%20%281%29.png?m=1783828643 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 24134\r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 11:58:20 GMT\r\nlast-modified: Sun, 12 Jul 2026 03:57:23 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 458499\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fdq7UpYPOOPJxxTfyjTNYXRYFSRq1vdfP0Q1FRx3A1N%2FDI7%2FCH1yAVLfEYOKjRZyPoSFnfay9V1EfboLgSVX9UoYOXZpBY9lNh%2B0wtArqAl0dDqXxD6tYVOm80Lo\"}]}\r\ncf-ray: a1cb99f71bd2b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24134,"size_decoded":24860,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"8f652546764832cae3a5beaa5eb6ed5d","sha1":"af9894c55fd8f6fc07f95a3cdc107767e62a6681","sha256":"774cfb754130ee4cd725e2c29ceec9894e18b0a5f5e85d26e73e394d7d060801","sha512":"56e5df87d939840f46f87bdc03d4fb8563dd3fd9fabd5319080a1bc70923c12d170d2e169ee9efeffcf2ed89f766167846f13f3e78720cdd7e79dd51bafeec25","ssdeep":"384:FJgDUXJGCZknppO501i8nccMC3HvbjcolXn6tamFKdlMtQ40oxpy:zLJGCqnpp9FccMC3Hv8oxnIamFWAQYHy","tlshash":"d3b2e1e6d59133d6e099cbb0b6566cab8c7d690cec2673308c121ebd5f1b43a3407587","first_seen":"2026-07-17T12:50:50.335857Z","last_seen":"2026-07-17T19:20:40.665163Z","times_seen":3,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":289,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-37-37-728%20%281%29.png?m=1783659212","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.529Z","timestamp":1784315999529,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-37-37-728%20%281%29.png?m=1783659212 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:53:32 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xh3bVj6XukYndWS9KujVhCJG0IIYQjs1QmJ8NDOO8OQrH7utzziqIUP06VRokZXeheL2BUPbElZ84cnptBpdkyx8N4A4ABpQRRbp87nXQIKbAgbLYvr3phq%2FgtHo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2d5696-OSL\r\ncontent-length: 36057\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36057,"size_decoded":36801,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"4a67f4061f4f180f41c41bb3228239be","sha1":"6949f1bda8790fae4a7866a97b586f9fdcfc7f68","sha256":"e5811a05368a77f6250866c5fcd3637524dd30da8a9c58a38330f819f1ff8811","sha512":"2640aea63b3f337d7c81c97c2e2dca685f8cc126d6f5a640ed0a85cc13f6d6104144efbf85f9ae63d4303b10be5c63e9142148854a886da706d0c04d1c6ad35c","ssdeep":"768:mEqo+nzHD/19D9g56g7HyjHEFiAThuiNx9X2CHZE4+kpqpUoPoYI:mEGHDN9DE6gOjHEFikuIx9XVH64+kJoS","tlshash":"07f2e1def8832293ccb70d1788691ac113e56419c22e2bb5d069f4397a7d347adc05eb","first_seen":"2026-07-17T12:50:50.298495Z","last_seen":"2026-07-17T19:20:40.665826Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1264,"timings":{"blocked":1239,"dns":0,"connect":0,"send":0,"wait":18,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/6.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.587Z","timestamp":1784315999587,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/6.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 48297\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":48297,"size_decoded":48540,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"75e307d48969a1cced6343bc07b8cecb","sha1":"eb823d8108ed97cfc6fb4ec688f35b29264253f8","sha256":"8727eee1d0ca83f30ca65f4743b25322d2409276db2c211f1ed91fc521600888","sha512":"23ab228ea6b352aea29caf3c22ca0470094f92b03759120781a4f57e133aafc9fc3b1722e47c4d8724f8cf1b1ce1a295fce088c4834a319fd02a229bcbe0ae77","ssdeep":"768:4QGkVxttxhq4yp4jOJRpc9Arhp69k+bEd2xSM201M//+sHDpZTpxwoLwlm5Pkra7:4QGkVxLxA4ypK6Vh4O+bkJiMHtpZ1x3h","tlshash":"3723f2809400963f43a3e47d0e895325affd213dc39670cdfad88b3527658ad1ba6f85","first_seen":"2026-07-10T08:53:16.01908Z","last_seen":"2026-07-17T19:20:40.666504Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2986,"timings":{"blocked":2700,"dns":0,"connect":0,"send":0,"wait":285,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/3.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.591Z","timestamp":1784315999591,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/3.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 11144\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":11144,"size_decoded":11387,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit colormap, non-interlaced","md5":"700d0363165d9d53ad505737dbf55b2e","sha1":"fb544424702c675432ccdfd4555d2dcb99a704e8","sha256":"26f1db83b64889918957025f8a0b0bbe6895e3d99398673ca1c727dee9d83423","sha512":"6b645c76e9dda8678cec981772bb460823a7dae6faef44d903089921336d530fcdcd7c9d6f8c6edf2f0ddd6780262b3d332b8425def8e1474ffc85a66a5985ef","ssdeep":"192:TuXqDLKkNw7odJP7IMfmKfwH2A7ieotdxiNH19cOGX/tPeWoAKDlVsTiwsdy4:TiqDOkNwUdJ/IWALyxiNVynJ+jsJsdH","tlshash":"0232bf8b07c5b00cb2332d0145ec641c718f6f5ea864aba097ae3b37463b1d5fa2687c","first_seen":"2025-04-08T10:46:38.430025Z","last_seen":"2026-07-17T19:20:40.667266Z","times_seen":81,"resource_available":false,"data":null}},"time_used":3111,"timings":{"blocked":2838,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/kings.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.750Z","timestamp":1784315999750,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/kings.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 30 Jun 2026 10:48:00 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 7535\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":7535,"size_decoded":7783,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (7535), with no line terminators","md5":"f8806242b756a742555827b5e549f8e0","sha1":"4f56f1a3cb590af2c9254d2e288b31dd2e5f9e17","sha256":"fce73f4de3039a1a90eed1c8cfa35a9fbda8d9b939d9b17131797d5a40cad5aa","sha512":"876af87c5309c38e6c9fd4444ec744611bd5bc759bd674ec649bc3faa114ce3742e277fda3f9a73cf8d698e0e7418a82804fa70332436aad5f7e477138dc15a3","ssdeep":"192:eV1HJaqJAAARANUbiNmzC3j32fIYlR+ZTURQE5P5Ksxgh85kebUP:eV1HJfWAARANUbiozC3j32fpRUU35FaF","tlshash":"b4f16a013dc4acea638bda56fa25f2d5f32e48d0f3905e2fd114e84364e53a2a5825bd","first_seen":"2026-07-10T08:53:16.047471Z","last_seen":"2026-07-17T19:20:40.667792Z","times_seen":4,"resource_available":true,"data":null}},"time_used":1773,"timings":{"blocked":1497,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/style-kangcopy.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.090Z","timestamp":1784315999090,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/style-kangcopy.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:20 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 60365\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":60365,"size_decoded":60608,"mime_type":"text/css","magic":"ASCII text, with very long lines (913)","md5":"57494cf934951dbf1c5ffd329482a46f","sha1":"078c6c4ac853f9e62ba2821e0072a9f3a9c1ce6b","sha256":"1f1ef993fb38eb706abfbbbe8a3e67b61874d0a5ead92f415ab105d09f9f0855","sha512":"76b490ca07ef0b7d283e6d39ba7c9ecef58df6a981068b97e299d9847dd990c30f908b501fdcf4f14a619e5ed6dae7bdd296e2a855a1cc33fd8e58a9485c75d7","ssdeep":"1536:XrRNMqDp75lpF4Y2oEmTbucehaPd0NRWgqi/wJoyS2qkCAyf0ZsHFyllPLV0q1nD:XrRNMqDptlpF4Y2oEmTbucehaPd0NRWp","tlshash":"604340931b331448f84ad5a9aff6571632191483a24fc86abfdc718ccf855d486a3f8d","first_seen":"2025-04-08T10:46:38.533894Z","last_seen":"2026-07-17T19:20:40.66917Z","times_seen":79,"resource_available":false,"data":null}},"time_used":1386,"timings":{"blocked":-1,"dns":0,"connect":272,"send":0,"wait":273,"receive":561,"ssl":279},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/6239946358894825561.jpg?m=1783828636","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.490Z","timestamp":1784315999490,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/6239946358894825561.jpg?m=1783828636 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 118219\r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 11:58:19 GMT\r\nlast-modified: Sun, 12 Jul 2026 03:57:16 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 458499\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CfAYT%2FJWggGPpn80zJy%2FBE1fJnR6aAaurq2rw97ukVFomBpgVGmZOAfMSUQSo5ovB0qOHU3V27Ab6pLdZoMjbgJ6KU1Zj3uk7HDzuA9nYssBSQ5IPsmn3JuEhecq\"}]}\r\ncf-ray: a1cb99f71bd9b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":118219,"size_decoded":118945,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x516, components 3","md5":"1cbe6fcf671d5da8ee770eae54defb93","sha1":"d25b346a418bf09c49b0117c5ffec1b07989c175","sha256":"26aa6c76354698ea25d59862da99153b67c99b9abf2f4a2c6082ecd83903071a","sha512":"120b8f9b026f68bdb25f1a62baf4fce6180dcf8c570bd6f3b3bc9975d3583d2c265eac105cb0fdd31e79fb9dbaf703a212475e9a95201c7b5f0778a254c2a328","ssdeep":"3072:7OXUpemhwKoEAEg/ng1lyPMTFqGVV2bqaj1:peQwKjAEkg1l8GCFj1","tlshash":"61c3125097c40168e51b1873abf77acfd58d709afd1e3ca2f302a9f14a865d9c87d068","first_seen":"2026-07-17T12:50:50.394205Z","last_seen":"2026-07-17T19:20:40.669695Z","times_seen":3,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":298,"dns":0,"connect":0,"send":0,"wait":17,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-36-34-145%20%281%29.png?m=1783659203","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.527Z","timestamp":1784315999527,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-36-34-145%20%281%29.png?m=1783659203 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:53:23 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EMGoCiezH1KbxOnMRxtl%2BH63mj5aRSYqH75%2F%2BKPLFWkmoxPGp5kBJahFcw9069RFtEUBkt8%2BUaKHVN5JqL9YFgYsWTH6rVQZzPcOMyMMYyQ5DENUw9R%2BQRLZfJFf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2b5696-OSL\r\ncontent-length: 33507\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":33507,"size_decoded":34259,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"f1454d4ee50135f6559443adfe137881","sha1":"c8251d8cc8df3aeb0db05339b97be47afee495c2","sha256":"2cddc259730a2ea1b358549f331c14a3dbe82fb0679cc8c64b2f61bac603b54b","sha512":"070049d17e0a308f6759f5a78441b3838630b8a6da6056f47e3ee36194c4aa6350b64ccb1ec2c291d4a0ca5170111d5e3811c74f66fdd62eed35474cb2b5f181","ssdeep":"768:+99pVkQ9Pb5RmBrbzotOvYCoGk0QEO4OvGb3C73ISeJIED8N:KjPb5RmNPVoG7y4Y6siOnN","tlshash":"0ae2f1b564e1b5f8cae004f2c2030808eb2bf0216d4cd857945d712ab7a9cc9d81f3ea","first_seen":"2026-07-17T12:50:50.441586Z","last_seen":"2026-07-17T19:20:40.670245Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1273,"timings":{"blocked":1242,"dns":0,"connect":0,"send":0,"wait":21,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/5.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.566Z","timestamp":1784315999566,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/5.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:46 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 14746\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":14746,"size_decoded":14989,"mime_type":"image/png","magic":"PNG image data, 535 x 522, 8-bit colormap, non-interlaced","md5":"f1c67e656b0a5664e58c9eebb763f7a8","sha1":"882470b3aeb02120aae304d59760d3431781428a","sha256":"bb03b0f5f2a5ce8f2cc25d7756ce6f25ce407c65c97c41b45f19da9090aabef6","sha512":"8c6c6030373824bd3b172df608539981b015d5eae4f8334c77b26ddba8584cf270f42d8fc3070cd8f203e72ae628b4776f73e24c9c3c6cbbcbed5f3e34359488","ssdeep":"384:u62w2v09FPANgn9cDxCfhnfX20n5VfCKjYwdDHlUXVSNiNGFdJ:DGiuNgn9dde0PfCZuDF4VSNiNedJ","tlshash":"ad62d0ac2c584fb839f54357e149a93e2827964e8d6ac4c705c1383c8cd96a76d33eda","first_seen":"2024-07-16T10:13:46Z","last_seen":"2026-07-17T19:20:40.670883Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2510,"timings":{"blocked":2233,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/tok.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.568Z","timestamp":1784315999568,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/tok.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:45:16 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 27120\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":27120,"size_decoded":27363,"mime_type":"image/png","magic":"PNG image data, 400 x 378, 8-bit colormap, non-interlaced","md5":"c85704bd5cffec72d2acf6943f2e5bdd","sha1":"37ea1097b7454b264883013e0ec5f1caf8b0b640","sha256":"084ac659b53f0cdffc3ad25079a26cee58f6866f559a597fe23d156ad05bff57","sha512":"21dfd42d87121e53fc43e6d463ee864b6a70e2b1bbb2dc48d359ff12b9c9b088903158b4b40a642d9cacbfd3049e41f2bb80d0a6db099244c49671ca08f6280e","ssdeep":"768:33F6oC2ziWcO/BIznj5d7MKPWhoQ0iph36hOi5EW:33QIzirO/8nNxMKuX5H6hO4L","tlshash":"aec2e0468a36f96f21d12c49cad49766958bcec4f83535f719d2a2bfd02340dd039533","first_seen":"2025-04-08T10:46:38.532057Z","last_seen":"2026-07-17T19:20:40.675501Z","times_seen":48,"resource_available":false,"data":null}},"time_used":3599,"timings":{"blocked":3323,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/Twitter-Show-Password.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.669Z","timestamp":1784315999669,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/Twitter-Show-Password.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 4909\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4909,"size_decoded":5151,"mime_type":"image/png","magic":"PNG image data, 656 x 656, 4-bit colormap, non-interlaced","md5":"f8172fd95dd367e6f3139c7307ed8b0f","sha1":"cead070bc6ba839f3b657994150dcb7a98e2f9c5","sha256":"78db20feae7b5d01f18a446fcc7914a049b6be1e958a08df353f0b1e2accf8d4","sha512":"e8ac9206f8a8931082605068a31f23822aba24e83e87dc9b36d3e38d68bb93500e9ecb810219f4db1eab98d323794210558eb1f7838f2f3cc20be29626001013","ssdeep":"96:3b9NV2vp8UWZwPFWFfdBQPbajKo/bO4z/j8INfeFZPzKQ:3bTEvqZwM3GPbajKhk8kfeFZuQ","tlshash":"4da18e0475b4fb5ddaef947e18ee32f5ce880c20dc14962d086717533048c5af6963b8","first_seen":"2024-08-19T14:30:38.125212Z","last_seen":"2026-07-17T19:20:40.676123Z","times_seen":74,"resource_available":false,"data":null}},"time_used":3745,"timings":{"blocked":3465,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/load.gif","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.717Z","timestamp":1784315999717,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/load.gif HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 2427\r\nKeep-Alive: timeout=5, max=88\r\nConnection: Keep-Alive\r\nContent-Type: image/gif\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2427,"size_decoded":2669,"mime_type":"image/gif","magic":"GIF image data, version 89a, 164 x 38","md5":"4d6f2e21a528b9bf09013864360288da","sha1":"606e36c12fcbcb77fe9447b2e22e94ff9b03b04d","sha256":"1c732615efde8aa29b32a71450c55d5d574a9f154eeb58baa8456de160ee6b1d","sha512":"e724acd650c885e0dc182bcfc4ed48b36c907a0ac3011cb1479f4a7ea6145b2d324fa529b2a6d3eb8ced06a53bccc5bc0eb86ecdac2e16d2ccfc0f8dd6bc0082","ssdeep":"","tlshash":"8641851dd184ad026c4c267c25f7ed3d051009307fbaa79eb8ace8153e5537e9b583ca","first_seen":"2024-03-29T06:20:58Z","last_seen":"2026-07-17T19:20:40.67667Z","times_seen":104,"resource_available":false,"data":null}},"time_used":4014,"timings":{"blocked":3740,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T19:19:57.991Z","timestamp":1784315997991,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:58 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}],"data":{"size":141745,"size_decoded":141941,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (909), with CRLF line terminators","md5":"9a430eb784f4c4316c92359c63ac8e1c","sha1":"0da85ce247e19d604656a4d2bce6f6ca49ef9c83","sha256":"68166d7f08206fd43e00dda7fd77dead5179288ec992dfc39a81ea6d790f12a2","sha512":"9e03e39b806a8d00040de796fafb6c0820899df79ffa43c449f3df9ee82d6b800b5bf474b0bd7325230e284d19f8ff67d0008965207ef3905428b410aa961fd3","ssdeep":"3072:2KmF6IC0gOFxVIXk7JjR4XtXPkkHZxd/Kp80NawFP/D758PftV:2KmF6IC0gOFxVIXk7JjR4XtXPkkHZxdt","tlshash":"b4d3f8a694116c1ad11383f6e7714b9afa180013db0745e6b3f8e697fbc5e188a737c8","first_seen":"2026-07-17T12:50:50.406874Z","last_seen":"2026-07-17T19:20:40.677315Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1712,"timings":{"blocked":-1,"dns":5,"connect":274,"send":0,"wait":316,"receive":825,"ssl":291},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"site-assets.fontawesome.com/releases/v6.4.2/css/all.css","fqdn":"site-assets.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.385Z","timestamp":1784315999385,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Jun 2026 22:11:17 GMT","end":"Sat, 12 Sep 2026 23:11:14 GMT"},"fingerprint":{"sha1":"5F:59:20:85:C5:A0:F2:76:30:C4:8D:DA:FB:31:7C:05:93:3C:16:93","sha256":"C0:AB:A6:29:FC:00:73:C0:2F:17:52:AA:D7:E8:27:80:98:13:B4:AB:F6:09:35:46:3E:53:8E:61:E3:6F:47:67"}}},"request":{"raw":"GET /releases/v6.4.2/css/all.css HTTP/1.1\r\nHost: site-assets.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://mail.itsmebay.rumahsakit.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: text/plain\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: a1cb99f44966b4f1-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":174,"size_decoded":516,"mime_type":"text/plain","magic":"ASCII text","md5":"b280f989a0da0e8260a2087d68882738","sha1":"00e82f44a5ea302878ec1ecef4d5d139833b63fd","sha256":"9bef8efa1e386da72f16fdaf2b5e34315ab4886fabf9c9319f54b25cc89d8b72","sha512":"daa3a26ca6cc57c86ec1d87eb17952b8b9932ad2fd597890fa85baac0ed2f4d0e8385873c1fc90e079ddfc7cd064933061faf4c3024023f57918575b9a948232","ssdeep":"","tlshash":"d1c0806f837551a04c1995611b0154b57f1134dc79609f4d7033055f1345d856d3da64","first_seen":"2026-03-14T04:58:49.851515Z","last_seen":"2026-07-17T19:20:40.678152Z","times_seen":205,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":3,"connect":7,"send":0,"wait":6,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/6.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.596Z","timestamp":1784315999596,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/6.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 25162\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":25162,"size_decoded":25405,"mime_type":"image/png","magic":"PNG image data, 480 x 480, 8-bit colormap, non-interlaced","md5":"a0e11a7d8eea7811f94578b389e327ff","sha1":"4bfcfe7df3495b2016ac023804f4072c90388afb","sha256":"fa96e5a6b527a55460b2855769eaad1cd9971fdccc74a7d0272309a4ba91a2fc","sha512":"f60e03ff640c17968e07122acd8f1f7ae3f6110671d4ca97acce500a62479c18fca9a4948bf35c32bb027e34f3c8baa53da33e62d84b4014abd618533d45f02c","ssdeep":"384:804Kfqa0jhHoTXn7vWeeAocay5rPERpx5tIg723IA2auivS2bfjDlAK/y:804la0jBorLWyrktIX3JZvSGl/y","tlshash":"3fb2e021dcfb9052cc6f28f4cc169ad706b39c5204264a73dae93b81dc5515fe50be9b","first_seen":"2024-04-16T05:43:22Z","last_seen":"2026-07-17T19:20:40.678738Z","times_seen":38,"resource_available":false,"data":null}},"time_used":3264,"timings":{"blocked":2985,"dns":0,"connect":0,"send":0,"wait":279,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/itil-item.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.851Z","timestamp":1784316000851,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/itil-item.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/css/shops.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Thu, 09 Jul 2026 13:54:08 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 38307\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":38307,"size_decoded":38551,"mime_type":"image/png","magic":"PNG image data, 499 x 499, 4-bit colormap, non-interlaced","md5":"582abe89c3e4e5505c22172101dde53f","sha1":"033e456a118f8d26821d636a7feb25d2f2e72e54","sha256":"8809708467ea99e72093577831d77af7811147ed40b74556d834fff27d5e5d2f","sha512":"d77774d8d13386646436a57a61ce2c77cabd6c2601bc136d1ad3e6e021e447dcbbd768932afd6b99f61093e1d624e6863cfd625b74e194968b4c5cb20a523a2f","ssdeep":"768:29laDSVgbPC6Hscbij+e1cW+dwX678sPgsmNTaK7UQ2epi2h3wnpQe7LNj7oIrx2:MUSVgbPC6BGjSIg8LsmNZAQ2epFr8LNo","tlshash":"c60301a62403a65f3918b27e7332638831c9bc41da5f60f84765a1fbc3590ddc63b91b","first_seen":"2026-07-17T12:50:50.404662Z","last_seen":"2026-07-17T19:20:40.679326Z","times_seen":3,"resource_available":false,"data":null}},"time_used":812,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":541,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/link.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.731Z","timestamp":1784315999731,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/link.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 1423\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1423,"size_decoded":1665,"mime_type":"image/png","magic":"PNG image data, 77 x 74, 8-bit colormap, non-interlaced","md5":"5a5edf2fd41d3ea775e6ffaa5c7a59bb","sha1":"e6d05117a92f036541f0120ca5f835280b16dc04","sha256":"81c3275bdbce0f01a81749e0f55f802fe3eb8d3d166e12b664312a9dffa08af6","sha512":"e191901577a458b1ed6af462d449db26c612e87e07e9fd8ca4bb89d80f3e418e158ff3c131cc50dda95a6a622208dc49a425cbc5e3c8e8a2ca53676334655eed","ssdeep":"","tlshash":"0f21e932b96cfe6e6ba67b60c0184782fe6ae85c8ad34f9657a48ca735e0545b00a100","first_seen":"2025-04-08T10:46:38.526467Z","last_seen":"2026-07-17T19:20:40.680153Z","times_seen":70,"resource_available":false,"data":null}},"time_used":4241,"timings":{"blocked":3961,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/slide-header-zone.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.745Z","timestamp":1784315999745,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/slide-header-zone.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:02:58 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 465\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":465,"size_decoded":712,"mime_type":"text/javascript","magic":"ASCII text","md5":"1946b2cd060c107e0364ea1a940b588e","sha1":"e8c74222814175adb8be8a3e6f021f2ff7d3b9f3","sha256":"0e01578d3c1377d90ed611cd992282819c3ad5ff9a0c435a9b765fbec084b27a","sha512":"aa1c3df265dfa85963edefa315057ae544e51cb5605c5098a2d6d5d47bd73eda35a6df714909eec95c5f69d6d56fd4d5247203fc16e840a1e51f1b4caf56892b","ssdeep":"","tlshash":"fdf0a00295ad3c14c1929428ef69cd0364e60902880ade84bcd8004f1fd4e55f1df7f8","first_seen":"2024-09-25T03:40:49Z","last_seen":"2026-07-17T19:20:40.680839Z","times_seen":90,"resource_available":true,"data":null}},"time_used":1277,"timings":{"blocked":1001,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/script1.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.747Z","timestamp":1784315999747,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/script1.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 30 Dec 2025 16:17:50 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 11584\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":11584,"size_decoded":11833,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"e270af607dda93c863ad433b2eddcd91","sha1":"bf0d1dba2a4298c3293e4b3e820c81ae581890b2","sha256":"fc46a6567798a2fce34eba8fc0aaecc9b0818842e786acd4b7880f51cf5784b4","sha512":"2975bd918a9c170b226d23ee3742f7cfc96a3257a793ddd21fd422e130eb6136b8ada25db7d6b158a461bfceddea75b3a71fc3b4f6c8cf10a5d975129862b385","ssdeep":"192:e3FQCpC164YFhuj48+iif9v4xqY0D46Mwi5GwYF5WL4cSiI8KnxqQcb4/MZiPt:e3FoJYFJhiQgxqsaiMwYFx3iOnxqUuil","tlshash":"58328d48f35e1e956e3380ba117b50102b6d6c1b1906ce0cf86d28d86f91f6dfe7a94e","first_seen":"2024-04-05T06:22:58Z","last_seen":"2026-07-17T19:20:40.681497Z","times_seen":138,"resource_available":true,"data":null}},"time_used":1340,"timings":{"blocked":1060,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/3.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.581Z","timestamp":1784315999581,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/3.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 36439\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":36439,"size_decoded":36682,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"5ed8acbd0cf25333e736e370b9134a66","sha1":"608053088460dff207ee13733ed842df784ccf2a","sha256":"bd4ca5cbbc9c3d9c7ef0130231026938f1bae809717cb00f7c0364c53fd202c9","sha512":"8fdb4ff5f1fb9899c8551e7aa318e80a0adb3fb8383e73f84538df3d4af981f1dd9c1d0acb7b1c0586a27d997c2e19f97297dd9517034d1f984a19a4a2cdd8e4","ssdeep":"768:QJ8KKSit2VDabcwT+izk1adFJLVWZqKMlQLMlz:QJ8KXZ0zLdFJLsglTz","tlshash":"6af2e1fd687b8b6866df44dc6b260cd2e40fa7107f5d014d7ba05e8922a32b94074f69","first_seen":"2026-07-10T08:53:16.022585Z","last_seen":"2026-07-17T19:20:40.682298Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2781,"timings":{"blocked":2509,"dns":0,"connect":0,"send":0,"wait":271,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/5.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.594Z","timestamp":1784315999594,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/5.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53726\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":53726,"size_decoded":53969,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"20eef2be1e2356f89238e4bb158f8c53","sha1":"ac69d54bfe5c2ae7449d08b59baa83793a05c353","sha256":"306cbfbad098d44c0b5b229522414c6aae9131a4132a70b5b281dd46ce066536","sha512":"b14100685d301b4c851ba6efb74272ebb2343def5fd3aedf4db4266e2c31a9c4e6365ffa0a387e79c410449d269a4caf5baaad3057fffc3e553791f3febb8355","ssdeep":"1536:a+LbV2H35KO5K3jGQkyrpPcXWe54xUd2ZgJcXDk/TaY4m:a+QHpK+K3i0rpeCzZVXDk/TaYx","tlshash":"ff3302d86b9b09518ec719b8f3751b56c9b0b2458f401500720d5aefbfbaf740a3b291","first_seen":"2025-09-20T05:43:57.405653Z","last_seen":"2026-07-17T19:20:40.682934Z","times_seen":34,"resource_available":false,"data":null}},"time_used":3231,"timings":{"blocked":2958,"dns":0,"connect":0,"send":0,"wait":272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/alert.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.687Z","timestamp":1784315999687,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/alert.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:02 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 864\r\nKeep-Alive: timeout=5, max=89\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":864,"size_decoded":1105,"mime_type":"image/png","magic":"PNG image data, 86 x 86, 8-bit colormap, non-interlaced","md5":"ed9ed3b6f30ed2cfccca9880c31a8dff","sha1":"b44c63afd786e8d38f5d0e472af1b742d4614515","sha256":"b72fde0c53592bcd7499b3541e087eea1b97e35c3cd6ea255cfefb0bbfb3c20c","sha512":"e8363f045fb563d9ea896fc911f9d3989a0750f9f6aedce379b0db327b2c83c030c171bc50e564ea30e0570cb816c9dfd4b390db3acc917af8bf9eb9670eec8b","ssdeep":"","tlshash":"981192db6408977de63fc3b2042f29c6652357dc2fe0250b02bb60284e032c6850861a","first_seen":"2024-08-19T14:30:38.125983Z","last_seen":"2026-07-17T19:20:40.683555Z","times_seen":74,"resource_available":false,"data":null}},"time_used":3783,"timings":{"blocked":3508,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.725Z","timestamp":1784315999725,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29671\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 17 Jul 2026 06:16:04 GMT\r\nexpires: Sat, 17 Jul 2027 06:16:04 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 47035\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":84245,"size_decoded":30634,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32061)","md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T19:20:40.684114Z","times_seen":59524,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/link.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.737Z","timestamp":1784315999737,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/link.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 30 Dec 2025 16:17:36 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5812\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5812,"size_decoded":6060,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"7b5414224fc4b2f543b68e143c014e2f","sha1":"b46a2278d376e2f4859ef1d193d042063061479e","sha256":"c386f4fb12f4de0ed51142708ef2fd7018d075e0cc00331220fd1214018ed7a4","sha512":"8a01998af5a929720d6fd5391bbb59869941c9dc1aff7e052384d220f433b2dd3cc79b45b6ad466f01f8baa12f025c474b0dc6ce46cb0d7e1e2e1b91278060d2","ssdeep":"96:VnXEWiHRwiKLAN4LSz7btQtMrAEevdlFLeN4Lq73hUJeJAJKE+6rd:l0WiHRwiKsN4t2rrgaN4XQJJB6rd","tlshash":"40c178047a195881997797b6b0bb9440eb2d072f0a114f09fcbc29c86f70f16fa76d9e","first_seen":"2024-03-14T04:42:19Z","last_seen":"2026-07-17T19:20:40.684613Z","times_seen":80,"resource_available":true,"data":null}},"time_used":1222,"timings":{"blocked":951,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.378Z","timestamp":1784315999378,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"269550530cc127b6aa5a35925a7de6ce\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:55 GMT\r\ncdn-cachedat: 08/01/2025 14:01:18\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1334\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: b0538b380dc7ddf8a39643be5721b1c8\r\ncdn-cache: HIT\r\nage: 3162651\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a1cb99f44b84c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31000,"size_decoded":7933,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-07-17T21:36:11.643805Z","times_seen":298846,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":3,"connect":29,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/link.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.100Z","timestamp":1784315999100,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/link.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 29 Jun 2026 00:58:50 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5124\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5124,"size_decoded":5365,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2e1da786b931c8245d58fdd965201f44","sha1":"a58cbb17c47c25b78a47f5ade36d6d2dd4daa5f7","sha256":"c03629af948ecb7dae8040154a3ea920b1bb30b6b9fdd6747840790206a5253a","sha512":"807bb4c7c8b8e14d61c9b09a2e801bbfd7299e3112f19ea6c476deef584324493a31167b77839df544d0252fb519ac8be66fc91ff9d7d7af7e4d0284a83645c9","ssdeep":"96:fH/xFExKazuFiQNNXtKwdw1xAQzahuLy7B:fK7zAiQNNdKwdw1xAQzaULy7B","tlshash":"37b1dc109711a105b0369dbdabb7b716e50824638347466fbff0b380cfb56689661fce","first_seen":"2026-07-10T08:53:16.085791Z","last_seen":"2026-07-17T19:20:40.685625Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1088,"timings":{"blocked":812,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/1.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.588Z","timestamp":1784315999588,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/1.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 43679\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":43679,"size_decoded":43922,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"53a7a4f45f7081ee1661708b448c47b4","sha1":"7058b3b4e275a60e09150dbdb1081e89de2a10d8","sha256":"314d645a55cb761932e62c04341cd76b4f16e91a4388640605b842ce0521930f","sha512":"9b78b9fd0d536aa67fae6f3d399f67b6d9c67574b5927e983636496c1a555f20c6701fe9ddaa7e6045ec4369644cae1b0bae2124bd623d6b174e597b1faffb03","ssdeep":"768:TVt8bObtyzfWZ7JLo2zr3cUzP0IwZJh3cIfyzhhL33MHKdS10DvmjO087iXIK3:paCbeWZ7JZzrXpwZJ+/3xs107oaVK3","tlshash":"ed13f1358b56ae2b08c49f7c83b64b82613d70735e7df27e1c4d0e8a66642e806bf45d","first_seen":"2025-03-04T20:15:17.255963Z","last_seen":"2026-07-17T19:20:40.686166Z","times_seen":39,"resource_available":false,"data":null}},"time_used":3047,"timings":{"blocked":2772,"dns":0,"connect":0,"send":0,"wait":274,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/guide/e4eb1c730c28901ed581443a28f421d3.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.739Z","timestamp":1784315999739,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/guide/e4eb1c730c28901ed581443a28f421d3.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 10 Nov 2024 14:34:10 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 15155\r\nKeep-Alive: timeout=5, max=87\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15155,"size_decoded":15398,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 350x200, components 3","md5":"1d8f07e923089a0cad5350c38051cef6","sha1":"4c71589596032dee874dbf8b6ab2f78e5da1b760","sha256":"7a60f6c5091b0ea536ddef3575bdcd839666997fc7283986f70b4192a4c1e27b","sha512":"bcd51a646105c9f5b575f07c99cea2a791476fcb9ed34d872bb02f2b09b07530303ab31d21ffb10b7c7e0d730bca3ecc11f67916d41f022d65aaeb7f408b52b7","ssdeep":"384:EsmYD9wJZYE7l9+nbDK/zOHddHMpWfM2a2QRm:7DD9XLC/z+dHV02a2z","tlshash":"a762d06aab39d517f586033bc086b11c2bddd22a82c65e8bbe55dc086e4d3ddf03609d","first_seen":"2025-06-29T09:38:25.03329Z","last_seen":"2026-07-17T19:20:40.68665Z","times_seen":44,"resource_available":false,"data":null}},"time_used":4273,"timings":{"blocked":3999,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/media/close.mp3","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.989Z","timestamp":1784316000989,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /media/close.mp3 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:13:02 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 12675\r\nContent-Range: bytes 0-12674/12675\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: audio/mpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":12675,"size_decoded":12968,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"2056bdcfbd551273ee207f8c6ff9d257","sha1":"6fe68c9917d3409710aee4147ada311093d33ba6","sha256":"d7633fdf0d543880acc3fdaf578728d7becc1ff429ba054921d3313f73a5a4a7","sha512":"01a0022764f49e0c395d9f40fc73f123a424401e388d05373ab44ad33bd046d106881bd1f158b417030eabd8c9b52504d19155c225a1a632ef3c99ffbe771399","ssdeep":"192:kI/h/NAQ/Qa4cLtUDImzKBlSV9hME7Be85sqHARf9jt5EIJMcL:1/LcktUDBzOWX7Be85sGIr5EUMcL","tlshash":"0b429e012b05c12ff7292f7d301f86b8e0983a8f2a22cfe1a0179f94887f151672d954","first_seen":"2023-04-07T19:47:22Z","last_seen":"2026-07-17T19:20:40.687161Z","times_seen":723,"resource_available":false,"data":null}},"time_used":2073,"timings":{"blocked":1798,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/google.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.104Z","timestamp":1784315999104,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/google.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:10 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 4698\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4698,"size_decoded":4939,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"388fbad0457fe4b616022568b8fd39f1","sha1":"a39a21e79084b4cf81473b3cfd7721e3a5bea3b5","sha256":"2236f910f185301a767a6b68b4e93f1617ab222bb9a4f6d7008d9e18ca3ce086","sha512":"27acaf2cb5f820f93f0bd181888e77072e21ef875786211469ba5e180649a401afd90203e100c70e99e73372c7c30f581204c9f3969d3bd1d3cadba29bc2cd13","ssdeep":"96:la0TUzTUs6LCLlQMk619By6g2dpXKK3KKk1:/U3Us6LCLlQ16PBy619m","tlshash":"6aa17a5aea105005b032dfbdbba38656e95a0067db0380b87f8d67818fb156d4771fcd","first_seen":"2024-09-17T16:02:29Z","last_seen":"2026-07-17T19:20:40.688146Z","times_seen":184,"resource_available":false,"data":null}},"time_used":1355,"timings":{"blocked":1082,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:300,400,500,700|Teko:300,400,500","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.387Z","timestamp":1784315999387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css?family=Roboto:300,400,500,700|Teko:300,400,500 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 17 Jul 2026 19:19:59 GMT\r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24899,"size_decoded":2599,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"dd59052c593dd4fd28220ef1c4ad1931","sha1":"dc1d41a2023de52c9a6c22813f4f3e4023fb18e9","sha256":"e1846912562de798b6a53af1f5fe9c464510701b176dacb7ec48fb8d20685771","sha512":"187d04ddbc2fca32f696fae47a69878f3eeba01bbbbb6404c9f7a6bc0c0acee7262676307f49f12d519aeca74f7dd239fb8d5b867f8411769abbf5b8cbbbee27","ssdeep":"768:3FsbbYSRv4wFMl22YfRiJhan6BBYERNeWwhQHHYORjUM+:LIHT/","tlshash":"e9b20ba10417440097834ce223cebf35fe1f62507042d0b5abfd9b6baddbca652693ad","first_seen":"2026-02-20T02:02:37.810981Z","last_seen":"2026-07-17T19:20:40.688642Z","times_seen":124,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":5,"connect":16,"send":0,"wait":33,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-42-41-226%20%281%29.png?m=1783659240","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.552Z","timestamp":1784315999552,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-42-41-226%20%281%29.png?m=1783659240 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:54:00 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i8DXvJX7QABy%2BQpf2p5GXn5IK8FAp4Dl%2Bq%2FiLG51j2hALVav3KnU4oRDbB9wZWFIxb4vvgXCQLsMvABKPVNa%2F81WATEXwNej7UoiQM5X7zi2qHCSISu1PKpe9BGJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b305696-OSL\r\ncontent-length: 38692\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38692,"size_decoded":39442,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"bfc6f78bfc15bd03ac9b1a8e787bf3c8","sha1":"14b826785cde101d3e424274a20e3544be65258c","sha256":"41172aa4e023a82a85e3a923c27df149a1202513b05e36fa9d5f50dde1123aad","sha512":"dc4d00ff093dfb6173562235472f4a4ce7519740395eed3b256d6e7460eb4f4823925ba284954cbbdb7b8eb897667ca0c97ef571d2b6101664abbf5c39d39f58","ssdeep":"768:CXX6AXXmLbT571Qr6Qo5uYnBLPFHa66Ds2SuOQybBdnHlcVomTQLac:CXXvXIT57vQoIYnBTF2DwbnFcJc","tlshash":"b303f16774c93b2e0d07b74754da1c87bb04137aaae1911b1a04b2beadb47eabec1054","first_seen":"2026-07-17T12:50:50.408802Z","last_seen":"2026-07-17T19:20:40.689062Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1261,"timings":{"blocked":1230,"dns":0,"connect":0,"send":0,"wait":21,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/1.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.555Z","timestamp":1784315999555,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/1.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:18 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 162866\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":162866,"size_decoded":163110,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced","md5":"4ca154d45283beaa334dc48f1892711d","sha1":"fbba31ca4359e12ebd8607711a526c3aefabe526","sha256":"db007f292cfa60a62c817f810f5c0bfdf937758832b44b0fb21a7cb7eb465258","sha512":"c1595585bea0b663866914a0850de815dc18ef8c94d16df20afa384a7b8d84440e8eebff4dedbbc289f6dbac15e773e26b7d0d84f9ed3cf40509319e8a255829","ssdeep":"3072:CIXDbMdyL+IQq/biW0sLsRVs4vxkQMV3lTTG6egvQLgozp:CI/ZqqTX0msTOlVG63IR1","tlshash":"38f312a08334cc793dc5289e2829584f3b4f7821be31a7a69c963d4d5731ba0e495e3f","first_seen":"2026-07-10T08:53:16.06324Z","last_seen":"2026-07-17T19:20:40.689661Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2632,"timings":{"blocked":2080,"dns":0,"connect":0,"send":0,"wait":276,"receive":276,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/4.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.583Z","timestamp":1784315999583,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/4.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 47321\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":47321,"size_decoded":47564,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"1625c98435c86147f14c95e089b57631","sha1":"ac1dc76dde9934faf3e74aa15107ec809705d178","sha256":"dc8a035120f921d9ae6c1833d03a5c17ace8e9dfb1ad80d0aeae2c603931dca3","sha512":"dd2c5b2b1cae0e3fd904fbfdb5f9d5f7cfb48a155b08925d9ec151326902e3e0c06d14a2334e0579b9885f662be36596c57e2124afba61e8fdc37f32cb272e92","ssdeep":"768:E97ldMnyOVraLoaCDNkw+yGBM3nllMwSJr6DRK8E/ijgeCkODszu:E5jqyOVrVhgw4rCE/ijgeCkbq","tlshash":"0f23f2a1a8263682295b15a6105004eb6df05aeb17b76fd5d3f8a1cced7f0f873c801d","first_seen":"2026-07-10T08:53:16.037268Z","last_seen":"2026-07-17T19:20:40.690246Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2908,"timings":{"blocked":2630,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/slide-notif-zone.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.744Z","timestamp":1784315999744,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/slide-notif-zone.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:00 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 572\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":572,"size_decoded":819,"mime_type":"text/javascript","magic":"ASCII text","md5":"fe5f9cefd8cdeb7223204985d4fcff9b","sha1":"07290f0580629134fae84811d25cf7e4efc1429b","sha256":"0876d5efeb88bbb02434e56b729b0285c11cbedd3c5ab2b5b7b18a2f8d89d240","sha512":"4e03d07e6893ddc0d9dcc0c76707e139096d8d83f30b2511dce95f04b1f91ec31446ea2ac931bf8998ae3c9f91444cd515b176cfc1f9ba3bac0e7d0c518da395","ssdeep":"","tlshash":"08f08b0db664293d49e3a43c1e5ac90138e80d008e08bbc4f8f860578fb0e252aecaf5","first_seen":"2024-02-22T16:27:46Z","last_seen":"2026-07-17T19:20:40.691684Z","times_seen":241,"resource_available":true,"data":null}},"time_used":1268,"timings":{"blocked":994,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/fonts/selow.woff2","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.906Z","timestamp":1784316000906,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /fonts/selow.woff2 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:32 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 22220\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: font/woff2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":22220,"size_decoded":22465,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22220, version 1.0","md5":"345579e8566a3dd6dc9feb5362fbe7e1","sha1":"df075dd0c26e72fd7df19948f07904c1eaa72ded","sha256":"1d0dfcc32b3be2bf3b3dbc371e9b7c5ce205f4bc6f7c8ce0226256cc7064c3e4","sha512":"948b48b697dc39d4c921ef8765053cb414edd47d12c69856191c5e28a580a1ebdb6020d2b8d5639d7ea89fa24fbdd73c16bc5e461b86f644420fffd3fe76b397","ssdeep":"384:1dPjUYc1ZQrSCantuGbZZHmv8m7Uh8OIXXS6pL/AzxeDxw+wBhQPyX/g2g8rYFGk:fJ0qrSCasGZZH9C+lIXppzAz0SLnPgCG","tlshash":"82a2d1a9a2a202d4dafe4405bde8f8b35cc2b43adfc687394a74f54dcc845d18534d5b","first_seen":"2023-05-01T09:29:40Z","last_seen":"2026-07-17T19:20:40.692296Z","times_seen":1002,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":275,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.910Z","timestamp":1784316000910,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://mail.itsmebay.rumahsakit.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 17 Jul 2026 19:20:01 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 150020\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\nlast-modified: Wed, 02 Aug 2023 21:01:56 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xpfrS43A1JMfZDZnmmtpbcPzPNghtab4o0h1ns9N3cd6DB4Zmoo69emyIzis8%2FA9HzgseqcQ898ScUl%2BjqWkjZWOxqCMbJ19%2FzXYI3x5YgVH4laz4THcg%2F3WTD%2FSTswOKGggKUTr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=5,i=?0\r\nserver: cloudflare\r\ncf-ray: a1cb99fdae3e56b1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150020,"size_decoded":151010,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 150020, version 772.1280","md5":"d5e647388e2415268b700d3df2e30a0d","sha1":"97f0942c6627ddd89fb62170e5cac9a2cbd6c98c","sha256":"886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9","sha512":"50b2ffd7537d0424286936cb7ba566004a664f447e4aaac8fa40ceb2850ead6cdb39c957515ae05a07aaeb8f6e3e428c4b95e4efa3edcadc9473e9e200bb47d6","ssdeep":"3072:vPtxURbSTtDXSLXe0itudYTPEnus4blfNUqKrC7ZOBS9C3bzlLX4/NKOTD5:P15Die0UPblfNUqLZg9I/Qk5","tlshash":"03e312e8c98e8e24452e2b975b436d4cfca1c97d77bfba0e2b5401b94f1e0521b34a71","first_seen":"2023-08-04T22:28:10Z","last_seen":"2026-07-17T20:57:13.123065Z","times_seen":39549,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/shops.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.101Z","timestamp":1784315999101,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/shops.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Thu, 09 Jul 2026 13:55:08 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 3832\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3832,"size_decoded":4073,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"aaf0c70840ae3046c45863b84b06abb0","sha1":"7d09f6aa13c5b16675979626d3b0a19e290e6ea5","sha256":"1b35baa0fa02ae8028a3e8de9894949093925190dad36a8c9844250afff42ec4","sha512":"2d7803199f2364bd931a23fd35cce6136f69c26fd2650122204d073a70658f2615439d15c67fe25d5d62a8518091f623e62e9286877c32669d22ff6e69a2d983","ssdeep":"","tlshash":"668141659d1c0109e336a735bbb01f9df9550457930b06abfbecb614cfa965c2322ec4","first_seen":"2026-07-17T12:50:50.429078Z","last_seen":"2026-07-17T19:20:40.693507Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1353,"timings":{"blocked":1081,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/6233133071884554928.jpg?m=1783659017","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.478Z","timestamp":1784315999478,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/6233133071884554928.jpg?m=1783659017 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 66485\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\nlast-modified: Fri, 10 Jul 2026 04:50:17 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600668\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=65iRw7I4zplOmjdVKIwok87wkT5hLhhIclcMlrabwlGedMEMeRV8OFc%2BWPK%2BdNBoPe2C9JG7A%2FmZwbdXBlgUFjgIErW3EIesujW4yTwcGGtl9K0mODMc7JTNaSuw\"}]}\r\ncf-ray: a1cb99f71bd0b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66485,"size_decoded":67212,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x516, components 3","md5":"175d2dfa58a6e8c3cb1b56ea13fa6195","sha1":"02581de41f187ed4c38bb82b394d9227e3ba43f4","sha256":"3f52ae93fe2eaf21a1875f0b198f2ef2afa8f034c32ca7d9f4a5d12ecd595d4e","sha512":"a41b473c5d50664336a450a9f07f6c252dc0f779e0e2aa78e4d59c4aa107df71d607affa38f677e85abca35035d2abf91244d06092627541bbcbfc7c56b424fb","ssdeep":"1536:sR0MXlhjaEhF4OJOAL/yBXkTCb3UoXph1CYQwfaIYRU:sR0alfj4OJOAe6TGXb15farU","tlshash":"c45302c8b35e0bfee09a467711b71818d01aa425ae5b527d65c343cf7d99e8c1eba0c0","first_seen":"2026-07-17T12:50:50.431405Z","last_seen":"2026-07-17T19:20:40.694048Z","times_seen":3,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":326,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/headset.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.488Z","timestamp":1784315999488,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/headset.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 14:43:47 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 96691\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":96691,"size_decoded":96934,"mime_type":"image/png","magic":"PNG image data, 1280 x 516, 8-bit colormap, non-interlaced","md5":"899035a4ea0798268c46cd3b8de8ccdb","sha1":"676b318fa62fac4c7b22284b7baf4d85dc1e9004","sha256":"cbe16da395437105028b9a06fc14788a0d11b4ad741874fec1dc4addd9241dab","sha512":"f2dbc66b1f0055067b4aa535d86ceb78a70847214f2cba68bd1e39fad584d126cb8b13b5388aff595b29ccfe20b0caa152ed9651ae05e5d30981de256cf83007","ssdeep":"1536:h9sRal2BE2Fr2REvB07kHZPj9MO2LKGiYI2HEGoUVv8ZpUFyvm03ebaA6PZifouN:MNBlBhH19MO2LS9UF+mFye03YIifzPF","tlshash":"9c93024292a74dec07a45ea19b6c416bc1c8acbefa9a16ed1d0333c5cd5873c6d3389d","first_seen":"2026-07-10T08:53:15.955304Z","last_seen":"2026-07-17T19:20:40.694661Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3553,"timings":{"blocked":3280,"dns":0,"connect":0,"send":0,"wait":272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-44-58-934%20%281%29.png?m=1783659249","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.550Z","timestamp":1784315999550,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-44-58-934%20%281%29.png?m=1783659249 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:54:09 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=smbgS2mR2R4leHbHxTFMZeiI9ZsksD9XvEm%2FhPhSrPiaU%2FQzG6k0PGqJdOHxOhLxymYorosQAVO1ko%2BVLMoE2ZbjGCZHkELzoGrfh8G7m2xWRqXFjcpl42QcX11H\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2a5696-OSL\r\ncontent-length: 41004\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41004,"size_decoded":41752,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"c1d0650bedd1fc5a709280ca8d433c09","sha1":"d2b45a69f12e118b8f8021deb2b410c05b4f33d4","sha256":"5a1832365d16a9cabe4cc371c02e361b9af4c774fcbfc7d4e9afefe451848884","sha512":"05eb23dd26ae896c57ac45bd04de4307b70ff8af86d886c6c0fd1eeacd71f123bd72f130159b352db74eca1f843352c92c7909499b2be8e6af0c57078b8a8054","ssdeep":"768:N99NupeemfdM8lms4ITPyscrDLDaJjR2QCqjGhrCYdgZ:+0em1M8lm+oHezrSDqZ","tlshash":"4903e1f7201df670239bd9b83bbab18de64c6ca16e531de62543b02952d2892437c5e2","first_seen":"2026-07-17T12:50:50.313252Z","last_seen":"2026-07-17T19:20:40.695245Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1261,"timings":{"blocked":1215,"dns":0,"connect":13,"send":0,"wait":20,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/2.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.557Z","timestamp":1784315999557,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/2.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:16 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 97597\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":97597,"size_decoded":97840,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced","md5":"33a3e8874d5b2ab6b81803f50e092171","sha1":"7d13060e534bd8fef7b8afc665a5469d444f05d4","sha256":"f48a8a62a0c08d738bd6e63d446c7c3cf699f555dcd83e247fa8197616444c78","sha512":"04a4e92e8ac5bed008665d7b3f492ea651055b6aa1b895e7b4b41cb88bff0847d8f97d9fb796a192b582a57a1b039320779b637db974d86d2e9440f7ea482f1f","ssdeep":"1536:GtLduRQmktB2CPmOWBs/3M5J6TVL1eKCYvv0+kDXpfBB2bTuh6ea/1gHyoFxJvQd:GtQRXjOv3mJ4SKCev0+0f8uh6ea/4yo8","tlshash":"169302abcef82949ef113b94c1a7ec94f5b62c2a65d87f913f752648ba014cc031b563","first_seen":"2026-07-10T08:53:16.080063Z","last_seen":"2026-07-17T19:20:40.695792Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2400,"timings":{"blocked":2126,"dns":0,"connect":0,"send":0,"wait":273,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/Twitter-Hide-Password.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.667Z","timestamp":1784315999667,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/Twitter-Hide-Password.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5011\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5011,"size_decoded":5253,"mime_type":"image/png","magic":"PNG image data, 656 x 656, 4-bit colormap, non-interlaced","md5":"7413a6863543f3f8c9dea581fc20caf4","sha1":"4b23133d6c8f22cfc494a9b85300afa1ab3a3d22","sha256":"72cf84c13f893824065b12d08a91725b1574da6ca4eaaf1e92e33b95c63fa6d4","sha512":"ca124897744169ea80d6db9ffc64358f6f7480685f2cae8c8692a4ff62c0db680d108100a3ccb2e6e66e094279f2a469a7f4314aa5cb40ad6210ecc7e7cfdd0a","ssdeep":"96:3AHt9SwHbwhy+27AI4RCE4Q5oDWONPgnej/Wex1C9YvYinZF:3AHHSWejR4Yoz0U/lx2QT","tlshash":"b7a13992a28a167ccc2404bcbb46d72c779742c91bf306d78e498de21e6bc19457b38a","first_seen":"2024-08-19T14:30:38.124513Z","last_seen":"2026-07-17T19:20:40.696766Z","times_seen":75,"resource_available":false,"data":null}},"time_used":3695,"timings":{"blocked":3424,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/media/kinnon-pindah.mp3","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.982Z","timestamp":1784316000982,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /media/kinnon-pindah.mp3 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:12:26 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 8972\r\nContent-Range: bytes 0-8971/8972\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: audio/mpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":8972,"size_decoded":9262,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 48 kHz, Monaural","md5":"46d794b8fcc24a09e9c43ee4bd88cbd0","sha1":"ad48470fe3664b0e8802697e86d8b60bfe0fb73d","sha256":"34fe11bdd5aa6a7295b2153d9124c96938439634ee236d77427ad00327fe7f62","sha512":"be84b1ab7bafcdea7ccc493f872fcec1e3f40d316a7005c6f3410a762a52d123543cbd2e6f20d645e220a520a12b60b4767bf3ebf21c79ace61a5734ec352185","ssdeep":"192:z8xVktRP71hHj+z+uJ0OJUZvjNOMY+gI3U5dmq8kEdmZRv:z8VgN1ljnuJ0OCZvhOD+33umhm","tlshash":"ae029e53a8730fdae0c2b830c1f7c781b6809f559eb8a0dd7a81f660b17957522a5d0f","first_seen":"2024-01-05T16:39:53Z","last_seen":"2026-07-17T19:20:40.697413Z","times_seen":163,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.383Z","timestamp":1784315999383,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18778\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Wed, 02 Aug 2023 21:01:56 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qGZqMc5kD0ctYgVmGeZnS1E9XM3vch7r0kNCnXe%2BdXpUy1sLhZtJzVlOBGMG1yVnV3LKC7Z1xe458jkdHqJ6n90BnHDjCkwUNmWfN4ELy6BJVAUK7mnb%2FChb5MDoMqqXdFX3sTBF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1cb99f44950b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102217,"size_decoded":19767,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"5222e06b77a1692fa2520a219840e6be","sha1":"8b4236206a8b86af3761a244277663046d7ff7ee","sha256":"0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5","sha512":"cf780ba5def29277f562835b0b3a9129ce2aca8afc81a294d6a9a7f824a1c5bb81bac00d23d42946884606b7821642b12e17a2e92f424171446db2aea8b8340c","ssdeep":"1536:0wMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuuprrlCq:M709gMGFiyPGuuprlCq","tlshash":"09a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-08-04T22:28:10Z","last_seen":"2026-07-17T20:57:13.122463Z","times_seen":45624,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":50,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/cargo/gilt.jpg","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.487Z","timestamp":1784315999487,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/cargo/gilt.jpg HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 432445\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":432445,"size_decoded":432690,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x516, components 3","md5":"5f3a2e7071706bf6351630b223f5003f","sha1":"1e077532d746818039ccf8391a66f1aaf540c44e","sha256":"a2b717beb12f02620dc542d230f6534eb67e3f5d4feaa2137c203e3ca4574337","sha512":"13c1ae6e2500d9b954607744bf1e57a9db105cdc8002ead951010c1983cd9760cb52a85fc3b54197c76d7ffc9e51ac6074421341c7d5229fcb44566b24e36017","ssdeep":"12288:+laPUUF35duxl/nM5DHKRrXQ6qEzrD0AHhAv:pPXOlfA6jzrDO","tlshash":"da94234817b1d0fde05347f306915a75aeabe3acfadef649912e331ca0c502b92e4764","first_seen":"2026-07-10T08:53:16.042187Z","last_seen":"2026-07-17T19:20:40.699977Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2256,"timings":{"blocked":1976,"dns":0,"connect":0,"send":0,"wait":275,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-12_10-51-46-303%20%281%29.png?m=1783828656","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.523Z","timestamp":1784315999523,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-12_10-51-46-303%20%281%29.png?m=1783828656 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 11:58:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 12 Jul 2026 03:57:36 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 458500\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qgoaIS1QTfzXtUmtRI%2Fro%2BaHkpU0aMfrwlLwN4xWfZeCP2%2BXVN1I2TMGEUqgCS%2FEhfj6A%2B2C%2FycsyqXyGMRYAePbsYAkSh60TpHE%2FxVNQCslJB66jwqk8kSdsFTu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b315696-OSL\r\ncontent-length: 30745\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30745,"size_decoded":31501,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fe2d86e8898e46a9cf43c1442ec5666","sha1":"e0df209afb39d4e1dd723e0f7e5e7dfcde9bff2c","sha256":"656c98898fda7ed345196d98853126bfaab92be79792a531fe6574e9c86335af","sha512":"237afc80dafc635cd29a022f84eca23812436b68411a229daa77d7aa7e25337b70bb15c0ea9a757b57e323e0b9194ae8ca296696c755e0df2bb72fbad6e179cc","ssdeep":"768:qJpXerKDDD1FFXdA7ifTi9/ljSob6qxQt3+Y4yldCvLzba:surKnx3biBlFbrWd1d0fa","tlshash":"05d2f1450f90010e8cdbd487507e9141b4f65f73d6a888a8b0af3a5e3bc9b750f11ba2","first_seen":"2026-07-17T12:50:50.38415Z","last_seen":"2026-07-17T19:20:40.700997Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1278,"timings":{"blocked":1247,"dns":0,"connect":0,"send":0,"wait":23,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/4.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.562Z","timestamp":1784315999562,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/4.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:19 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 158251\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":158251,"size_decoded":158495,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced","md5":"3f5b77b73b639686d901ab94d823ca09","sha1":"166918ab4b1e26565295baa08c2ff8f59ffd9e2d","sha256":"a39f7661be6dc3f16f8fd82e83a83a6d759a01d857ed8e4bc3712c77ad9e1dfb","sha512":"5fb2add156a45cde1e7779e13887c58fff5a5d0e52882247a78553dd82f34d7a90d78356d888332317747b0969333b35229d1e0fec257303757b5bc3c08f9d16","ssdeep":"3072:8aW+0mdZkdLdyAIOSHBywn4Ke8qfsQP92HYjna/5t:fb0mdmdLUJOSHXn1edhP/C","tlshash":"14f312b09a95ea8bdce0a7f22b51e8a57fa41b8b7e1cd304355a61050753d39b330cb7","first_seen":"2026-07-10T08:53:16.017465Z","last_seen":"2026-07-17T19:20:40.701591Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2499,"timings":{"blocked":2209,"dns":0,"connect":0,"send":0,"wait":288,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/5.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.585Z","timestamp":1784315999585,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/5.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 45864\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":45864,"size_decoded":46107,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"fd89f847963d25b4c7dff187478fbd39","sha1":"88e36d6c03a703eb0b3979c18c23f845cea7e871","sha256":"ef5599a1072ddc17ee78d24337530d6f53b564c0b3e218090b151f8771d23424","sha512":"d6c8353b7c356e90fd8005f0f111a1ef71bd73607a35c09d8730b14289ebd0232161f4a4eef89c7371774696e4b708c057064e863ae1587dba0ada17d845c485","ssdeep":"768:5PQcBmKzdfOXrP8IfRRqehdjfvEX2nY75ngVQcyliWbI5gyGynfqafXpRSzltg8L:5Pn5fOXNXxoGMNUTGyxCzXghKjHF","tlshash":"0723f1a5be49c130df277011317aef091bf56d91f4f53f8a91e88cb5443da9a8409ba2","first_seen":"2026-07-10T08:53:16.024018Z","last_seen":"2026-07-17T19:20:40.702673Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2959,"timings":{"blocked":2685,"dns":0,"connect":0,"send":0,"wait":273,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/icon-twitter.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.599Z","timestamp":1784315999599,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/icon-twitter.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 820\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":820,"size_decoded":1061,"mime_type":"image/png","magic":"PNG image data, 86 x 86, 8-bit colormap, non-interlaced","md5":"bdc76fddca88adf48a905463e749fb35","sha1":"c5c278b65bea26acd3afa3a9f286b64e3d437224","sha256":"043f08b0165486b465ba3aeac55e6820df8e38f77c7a83206ca99fdb065bb1e0","sha512":"8858443a265148fd5cffb3241eb8ac23ee00314a8c448847fcf61c6496dfb86ff06b9f3683d3cd5906803bf9b31a05ac7e297f738c0776a8c5407ed2009bed6b","ssdeep":"","tlshash":"0301d6db4e01bd948c7b422980a045c12a367a0c78a8c28b3c03cf1a9c998dc85d8445","first_seen":"2024-08-19T14:30:38.123183Z","last_seen":"2026-07-17T19:20:40.703665Z","times_seen":74,"resource_available":false,"data":null}},"time_used":3658,"timings":{"blocked":3385,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.723Z","timestamp":1784315999723,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-1.10.2.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-16bb3\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\nage: 1757723\r\nx-served-by: cache-lga21955-LGA, cache-bma-essb1270062-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 12783, 16015\r\nx-timer: S1784316000.762269,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 32788\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93107,"size_decoded":33429,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T20:04:31.567013Z","times_seen":16543,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":3,"connect":9,"send":0,"wait":9,"receive":5,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/guide/e7acdbd75bf8259cae9cc3a6f3d6ca01.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.742Z","timestamp":1784315999742,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/guide/e7acdbd75bf8259cae9cc3a6f3d6ca01.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 10 Nov 2024 14:34:10 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 10414\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":10414,"size_decoded":10657,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 350x200, components 3","md5":"a98bfeb18e1d2b24b35436706be2fa2f","sha1":"c589b79fc3ff1c1d4f3c79c465deef8544ff7bde","sha256":"0916bb845f2f8eb332936e20ca944843b092d413b4df3d96ae112c6a1b88ee32","sha512":"b40c2ef09a3d08c8b6a8efc2011dd047e4fda16bbfae350e3b52d170a96b52b347010a77c3d148075a5dd587e5171157008c5ace1641b030aaa03d1a05bbdf76","ssdeep":"192:wl6NiYUBdwIRCsqtydOzNmX4Kq39HOUlbTBrpsmtK+AdMA+/SLMTB9LOETNL4:Y6IYu4L0dV43t9TBrpBtK+AsiGL4","tlshash":"a822af43efda3b3ef12941bd514c1b250fe6aa630326053ba7391819f4310e79be1a5e","first_seen":"2025-06-29T09:38:25.027511Z","last_seen":"2026-07-17T19:20:40.704796Z","times_seen":44,"resource_available":false,"data":null}},"time_used":4424,"timings":{"blocked":4140,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.381Z","timestamp":1784315999381,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 5845\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:12:09 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U1zh3JPPIyztPHY4MgSfU2gd5JrSRSz9lNhZ056htxp%2BSm4EI%2FnCM1tx%2FGOoU4jZV5xXjfFvtoRI1pJ%2BPBB1jBjE9zaCHwTy6B5pZOmbq5lyOV0Qs8g2f8lAUItFVyHVXJnjRypG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1cb99f44946b28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":70815,"size_decoded":6837,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"e9365fe85b7e4db79a87015e52c3db6c","sha1":"2e2b5eb6e08f0f3d11fe0ada97c962a23ba6a0d9","sha256":"dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56","sha512":"ad142d178576c2d02f5eca2ee22500b369171e2dcb8fd344ef1251efb0c4ec61ecc6063d4535b2f77773317803206f13a224530f8e55b0335d4e251a80e15e64","ssdeep":"768:/KvcqyF7I4rb84dLM+JKvcqyF7I4rb84dLM+k:B/nLMu/nLM5","tlshash":"40631be8e80900d26fb1cc03ef62b7ca1685f0a3f9d10dd8f17a998c29d16551597fab","first_seen":"2023-04-05T03:25:07Z","last_seen":"2026-07-17T19:20:40.705366Z","times_seen":10605,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":2,"connect":25,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/icon_fb.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.692Z","timestamp":1784315999692,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/icon_fb.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 3095\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3095,"size_decoded":3337,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 4-bit colormap, non-interlaced","md5":"a0850b6660df2d1a0e77e5155e64dd51","sha1":"b737534c5ef1e3171ed74b57ce9adf7c8961e6a9","sha256":"5a2e48b9cf0704a710e499282b0b3387b8057c5ab9d05bb1681607c6a82b477b","sha512":"ca53a35ea7284c4621cf821c9fa6da5ce4bacedca6d17b7e0e473d7b5f42b25ebf8c0fa2d7a2f6d8f630ca6ea76e72ab8ab5b9a2f0a0c68168f0d068ad600928","ssdeep":"","tlshash":"d2517e812a45a91943ec0e70d947162d67bf43865d31661034a7371f81cf7445f7333b","first_seen":"2024-11-12T17:04:27.209473Z","last_seen":"2026-07-17T19:20:40.705891Z","times_seen":114,"resource_available":false,"data":null}},"time_used":3921,"timings":{"blocked":3646,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.721Z","timestamp":1784315999721,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 33018\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 15 Jul 2026 16:21:35 GMT\r\nexpires: Thu, 15 Jul 2027 16:21:35 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 183504\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":92629,"size_decoded":33982,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32089)","md5":"397754ba49e9e0cf4e7c190da78dda05","sha1":"ae49e56999d82802727455f0ba83b63acd90a22b","sha256":"c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4","sha512":"8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb","ssdeep":"1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe","tlshash":"8c932bdd72d2b03257ab30bd106f540ff2361959280d8850f268d8f9bc79a49a277f6d","first_seen":"2023-03-07T01:02:08Z","last_seen":"2026-07-17T20:09:26.384417Z","times_seen":71058,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":2,"connect":18,"send":0,"wait":19,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/google.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.728Z","timestamp":1784315999728,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/google.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 10 Nov 2024 14:36:50 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 9268\r\nKeep-Alive: timeout=5, max=89\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9268,"size_decoded":9510,"mime_type":"image/png","magic":"PNG image data, 480 x 465, 8-bit colormap, non-interlaced","md5":"9fd2c79aa38ebc154913f849f854f059","sha1":"6b42a4bf21a8ad037f4df4dfb284a5675303a84a","sha256":"1c92dbfd03f5a35ec4c551da03831186ea678b8581612549329959e6453e5916","sha512":"38a58ba763c3fa75f38ca424154628c3dcbcdb7776bde116c00b630b5dec7f1db41a0821b522329a512520bc57f513b268a990b726703c4d1b86729ff9771939","ssdeep":"192:Ld1orL1SsWUXA5HXKOCWglVFbI+Dyz5D1qWCBm9i2n97rtNo8kJKySHYSS8j:x1oP8sWWAFXKgGVy+Dyd1qns829E8kEB","tlshash":"4912a05916881f178a0eb31c5803d5528b433674380b22693772249ca93b6ef4dbfbec","first_seen":"2025-02-11T13:44:57.719263Z","last_seen":"2026-07-17T19:20:40.707055Z","times_seen":135,"resource_available":false,"data":null}},"time_used":4172,"timings":{"blocked":3901,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/senderv2.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.740Z","timestamp":1784315999740,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/senderv2.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:02:58 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 93345\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":93345,"size_decoded":93594,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a331c1236fa6f0dd6c9f3f9e98df2e9a","sha1":"5121042afd07566cb65f1046310e6958972db704","sha256":"add7fa0bb5ecff1a86355cc79ac10ec188fc78981ac88911a590b6d53692f034","sha512":"86251be8d03f0ca5f409f7ed03854d31bbc5bd0f97f59fbc7790da1ab3c8911b120883926911afab8a85ba1d19f06ee1a9959a476c28fcf0ad2c42c9e8cbe463","ssdeep":"1536:uKQY+JGsQzbPOe28QUm+I8jKqmLSIPHchdaevC1sGlIC1q5Y:pbBan+IZLSIPHchdaevC1sGlIC1q5Y","tlshash":"669340c176c17c8603876b76371bb1e6e53f4c986184899af110fc90f4f9a22fae56b1","first_seen":"2024-02-22T16:27:46Z","last_seen":"2026-07-17T19:20:40.707586Z","times_seen":132,"resource_available":true,"data":null}},"time_used":1811,"timings":{"blocked":994,"dns":0,"connect":0,"send":0,"wait":272,"receive":545,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/Picsart_26-07-09_20-10-21-468-removebg-preview%20%281%29.png?m=1783603856","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.861Z","timestamp":1784316000861,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/Picsart_26-07-09_20-10-21-468-removebg-preview%20%281%29.png?m=1783603856 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:52 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 13:30:56 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600668\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iWiU%2B%2FM4b5mQSjpZLl%2BhJAaxeDh9Mibw0w7w1WsjF6kBwy6iFc29eQrJ9f33MWrfpIohlAnNMHOUDKx36tLY96uP6hezv4c4wV2TvvQmlLoUrAQpvW4XpbaKMCFU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1cb99fd5b355696-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 81197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81197,"size_decoded":81945,"mime_type":"image/png","magic":"PNG image data, 987 x 253, 8-bit colormap, non-interlaced","md5":"b56a585a92e46ca3664c379ff0515738","sha1":"0a38b0b06310173f1e6806dcf8c81c202be164c1","sha256":"68f37d182f4f05ebb476fd9bdc8ce0fb1c8b1b996603d4f1fc7f1d57bacccf95","sha512":"cde561c06df223161bdf10bdf104f1c807ba1b45ebccdf8b583f7672b671631d21c2409c7553950455b826914dcbd9d401a311d91a61a644f2fe78ee487e149a","ssdeep":"1536:MvrL1vNxrm7gAsOVRby/ijbITko/1sghcOwoDHkHgCmWuqUTp+vKDpD7:e1vrsHDbPPakdghcZo7ggEuq+phDpf","tlshash":"b983120cd6b3dc7755d20113f2fc9ab481c5ad9515b9a96e81863e37263e2b3b220f93","first_seen":"2026-07-17T12:50:50.332106Z","last_seen":"2026-07-17T19:20:40.708116Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/fonts/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.904Z","timestamp":1784316000904,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /fonts/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:28 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 24996\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: font/woff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":24996,"size_decoded":25240,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 24996, version 1.40","md5":"2018d35e708e07985693c6bc12a59861","sha1":"12faf69d54217b30d4458fffad689e758b8a91c6","sha256":"c2293fa86d99d0f1f06b2ac7f85ae0517e4a3bacfd9946de7b012f04aa2d831c","sha512":"5f80cb586d6a9c04f1f3e550283694d99fdb98bd37298dcddf94b1add4da93dfa315d123cf6527fd051a012fd38c0f9f642f707ce9f914c5a7075747be7fc42d","ssdeep":"384:HsmgD0cC1mO9aJlKA9BsPsjL+baPkl5kaa4t6+ECn9CWDBZ1hZXjhY4ev+Vmn:MmLmHJlxuPl/FT1DXjhE8mn","tlshash":"6db2e16940090d26c0722a71d3b293d8774053aee2d60eeb86790d6eddecd933c79eb5","first_seen":"2023-04-10T08:44:25Z","last_seen":"2026-07-17T19:20:40.70864Z","times_seen":499,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":275,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/media/open.mp3","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.988Z","timestamp":1784316000988,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /media/open.mp3 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:12:58 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 12675\r\nContent-Range: bytes 0-12674/12675\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: audio/mpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":12675,"size_decoded":12968,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"58418a30e1310bf4fafa9fa0e57c18d6","sha1":"b477e72668b181c3080d6b921e2edf15ef134f17","sha256":"d5ad34e8bb64fba432c1a12b24cd1e532104d0183045e73abaaec72aa824df1d","sha512":"082eb64f97dd80d382019c11f002badf74c35ba0c27e7d6ddbf04a0ef8f028b005a183224c6481f642f06609b166c1b24dcedb248d5a3f756492a88007c8daa8","ssdeep":"192:NRg5B+tUSp4IpICb0rswRVqb+nmCkyKEM7+sXspvPC9y8ZlgM:cvmmr1+60Ff+uP+M","tlshash":"26428e077f56010ff9e4a73531af2431e9c45e5e28a9cbeb36108bc095af3947b295ca","first_seen":"2023-04-07T19:47:22Z","last_seen":"2026-07-17T19:20:40.709184Z","times_seen":728,"resource_available":false,"data":null}},"time_used":2000,"timings":{"blocked":1727,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/6232992635043909477.jpg?m=1783604750","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.476Z","timestamp":1784315999476,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/6232992635043909477.jpg?m=1783604750 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 124918\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\nlast-modified: Thu, 09 Jul 2026 13:45:50 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600668\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cLnbl14rMvHqk6inOb%2F9xRO%2F%2BtZb1pGMFxj6QsNenD99fBp5aQmmB3Fy1XVhprpnTRdFlPWClg4UFdaOeuPWRnpPpmN%2Fml30F90Us0f%2FuqJauTBhy2MAvd0Wg7YC\"}]}\r\ncf-ray: a1cb99f5ba98b4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":124918,"size_decoded":125650,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x516, components 3","md5":"80b1f669fa147bc83d589432d3fdff87","sha1":"37b41cb52041909e2e781dedaa069c44d7426e6b","sha256":"2ce0a676c17c7934046a4d07ed9731479bd1fbd2b1b739a7cfcc3f147050fd3b","sha512":"1a54285c9e9baef660b675cca9484dda64eefe214acbae88ad5bf31312c830c5a40dc19f3ba52860c9d99e2df4ca7916f54cde315ae96bded0f6cf5985e4d72b","ssdeep":"3072:MuiI5tPpNmxe50JjUPDPH9MkTngk3I1nUI:MuiSBNaG0JITikUK0nUI","tlshash":"13c312bc73170f2cf28598336bc9b6a196e171295f744b82e5028dd1a766394e43bfa0","first_seen":"2026-07-17T12:50:50.356022Z","last_seen":"2026-07-17T19:20:40.70975Z","times_seen":3,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":112,"dns":2,"connect":1,"send":0,"wait":22,"receive":3,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/6217705605191898307.jpg?m=1783171455","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.482Z","timestamp":1784315999482,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/6217705605191898307.jpg?m=1783171455 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 17:49:38 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 04 Jul 2026 13:24:15 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\nage: 437422\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yFjRpHht%2BRmoLAKYyQIwFeu%2BhxzaYr0dLhLd3iwV5S831QfoQOLnmI1PKPALWy3rqr4fGrxc%2BNU56k9H4gIu7Wbpb%2FUy8yDpgGUpbnnw683iTPwp4MFfcffFEOEU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2f5696-OSL\r\ncontent-length: 116588\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":116588,"size_decoded":117348,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x516, components 3","md5":"e82bc3150b6407850dd75990136ab307","sha1":"0fcb5daa8728332d8e022b5c4a1e9abd452d6fec","sha256":"88fa8d82904e77fb75f696908690a3773c0d203d80b425dad6829b0e7bdfa508","sha512":"420937ddfc2038fb02d28d8c3f909264233fd403f0075945aaddb967c7b539d8ad15146367dcdf04f5a2c727cffffe8f0e0786e6a6d20f71b0ae2f3e029799a3","ssdeep":"3072:KbuFh9rxJwxP91z5pqP2C5rPlf5isnmF8Khy6CNRnCb:8S5xSdGP2GtxRWLy6KRnW","tlshash":"8eb3122873005eb4c2168f3e52f54911f26a7183a98257ef6e616fd835b06f0ecd8c9b","first_seen":"2026-07-10T08:53:16.088706Z","last_seen":"2026-07-17T19:20:40.710549Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1317,"timings":{"blocked":1284,"dns":0,"connect":0,"send":0,"wait":23,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-41-31-151%20%281%29.png?m=1783659221","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.532Z","timestamp":1784315999532,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-41-31-151%20%281%29.png?m=1783659221 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:53:41 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3aEPRMcJRvFwBJrjmVkqLkmAl1w2G3LWDg5%2BXvRaL3SUYx5L6a9LhIcQ8T2r523l9sRh8rdy69OnBXsdIBLtpsKPUngN9gE%2B33yQpuQvzYUvHiBcFtNBAmbWvWs3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b295696-OSL\r\ncontent-length: 41930\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41930,"size_decoded":42676,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"801e8b3d2ae8443a582bbbbfff0ae18a","sha1":"13a91f8aa746bc51c9ff4ca49f17811d8f3d02a4","sha256":"2f2e6aeeaf94f8ab7dd47d0447e11e73736a1e143596212d17ee6f58afaf1459","sha512":"9e1819281acd28ef08724824eb8d292230cd71d22a7f14362056631202cb9ad7c0af2ece77f10a3b5a0e3032f7f46b78f655cf0fec95fbc9b97310eabc36249c","ssdeep":"768:il5iH7cbzBQC3iwnsZIUh/STbRWP0qbpAsMR84SvRLHeKOuDS45qfGUscXyo1:ilkbQKAeqaK89vlHeyqfGrcJ","tlshash":"241302d2a2a1674687131d42e66f80a29dd96b13593b0e4937bffc00ce70241cb9eed5","first_seen":"2026-07-17T12:50:50.301403Z","last_seen":"2026-07-17T19:20:40.711501Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":1232,"dns":0,"connect":0,"send":0,"wait":21,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/2.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.578Z","timestamp":1784315999578,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/2.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 36651\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":36651,"size_decoded":36894,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"4e802fa7c124d636afc36f948b35985d","sha1":"fcd9884e1f705dac01bf1d7c8466e47c91bf85d3","sha256":"5ad898c72fb5e75b1cae0d09dd6c881040a5c421e4c1aa57fc4322b5954da92b","sha512":"e0564cf2b6167149639e64ab08f450e8d1cba9d02ca44f97f4c69c8c5495010c673b230dc05022fde6875d343e2332c649d09b1a6d5e4bc0995318dd1ffefeba","ssdeep":"768:bX25JcDOOAkoo7DChuRe9oRrI6c+6YIzQ8o0T9:TGBkoNhnr63Is0","tlshash":"1af2f1feb8e92491f283365a10499221ea452404f27b5ce5a5cf8435bb2f2940e5ff7f","first_seen":"2026-07-10T08:53:16.030187Z","last_seen":"2026-07-17T19:20:40.712003Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2772,"timings":{"blocked":2497,"dns":0,"connect":0,"send":0,"wait":274,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/logo.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.720Z","timestamp":1784315999720,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/logo.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jan 2025 12:00:30 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 116914\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":116914,"size_decoded":117158,"mime_type":"image/png","magic":"PNG image data, 1280 x 282, 8-bit/color RGBA, non-interlaced","md5":"28830ea121d73fae13ec14755488f67e","sha1":"efdb30615f6769e21c52388a13de1d3a4e4b561d","sha256":"5809580051286a413883facd055acb59730c31e87a405c6beca5d5ea51260f62","sha512":"38340e77b103c3bc7262d4bbb2d9d34921efaa327f8e053cb5ed768f1464ba9568f926ac0ccc65c490f8676b969e72ebde04f4caa0932ca912369a31b9e34407","ssdeep":"3072:p3DKPT1CzNokP3iRwDuX5W3gczpn1WtNcGRU7:FeCzNoCy2uJWj1QCG67","tlshash":"90b312d74a2bc066efaf62bc74605bd6f25d01b08114e273176adf84e1fbd3965803a2","first_seen":"2025-07-27T06:58:26.712918Z","last_seen":"2026-07-17T19:20:40.712915Z","times_seen":49,"resource_available":false,"data":null}},"time_used":4339,"timings":{"blocked":3793,"dns":0,"connect":0,"send":0,"wait":273,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/google.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.748Z","timestamp":1784315999748,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/google.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Tue, 30 Dec 2025 16:17:26 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5865\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5865,"size_decoded":6113,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"54c5eddc078f9f65112588c23f437a91","sha1":"114cf451addc7aee256f46817e300e293f4d508f","sha256":"90f1886566de647d909fd3ff13fc3a7690aeded832ccf0cbea6b14021bb51874","sha512":"547262bdad60407a599c732c4b79d05c2e3e91d2c443af1ed034555cf5916786b23ecc18ca8b2bdc371e0d2389f0d49b82eb56c210446cd4ff015a6cf9e01f7b","ssdeep":"96:Miv6Ye48stLy4LjLFLlJX4MAP11lOZL6xgSIIBKut8LYLWLsLfBPS5YgP65t9h5J:rdZ8ste4vJGPicCwqnW","tlshash":"e0c13a0ab1291e9f5972d6b621f64404bf7c182b45418f0cf9ac18c42fb1e49bab7dde","first_seen":"2026-01-02T16:23:08.558676Z","last_seen":"2026-07-17T19:20:40.713401Z","times_seen":24,"resource_available":true,"data":null}},"time_used":1348,"timings":{"blocked":1074,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/gas.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.853Z","timestamp":1784316000853,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/gas.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/css/shops.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Thu, 09 Jul 2026 13:42:43 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 65259\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":65259,"size_decoded":65503,"mime_type":"image/png","magic":"PNG image data, 1581 x 158, 8-bit colormap, non-interlaced","md5":"d47a4a7c44126d041aace08474f18acd","sha1":"55655fb24c34130b7eab951dd2656f9f443e37b7","sha256":"7b8e1e5dc12c8c718aaab56363475c6c336c3ba2b411f778a83eb731fc7e9e24","sha512":"ab6123eed206de594cd03d6b7cd7e104946b551d7ab7a65206d064f56516a400c5ba83560603426d9e377e2efdf6e29a4798ed2eb14f1e83443a6410e14d4542","ssdeep":"1536:Yfa9la0UzTRUCX1CxuVCxAdX2RrLBGPoaYOFAovEkxJRRqt62XYyaFZCfG:TaRHRWx8dX2BFao3uAo3xNMIlC+","tlshash":"c65302a3473c4baf3c9e595f6ec41a4c843dfdcd66a2ab673f78355a26716808613044","first_seen":"2026-07-17T12:50:50.325664Z","last_seen":"2026-07-17T19:20:40.71392Z","times_seen":3,"resource_available":false,"data":null}},"time_used":827,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":552,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/Picsart_26-07-09_20-05-43-100-removebg-preview%20%281%29.png?m=1783603843","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.855Z","timestamp":1784316000855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/Picsart_26-07-09_20-05-43-100-removebg-preview%20%281%29.png?m=1783603843 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:53 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 13:30:43 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600666\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ef%2F7sxaXFnG4iz7%2B%2BGcRrHy936MNvVMYVQOfnJp%2FXWB5%2FgdV0KuBI296Sua716oVXjh49V8kdI7dGCrBapiEsJ2YyBr%2FXO03DiRvul%2BUbev5lshJ1xnGC7tCyORE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1cb99fd5b335696-OSL\r\ncontent-length: 76186\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":76186,"size_decoded":76942,"mime_type":"image/png","magic":"PNG image data, 572 x 436, 8-bit colormap, non-interlaced","md5":"796d80106b9c2e9c74c5a159ecbf7c17","sha1":"82a93e84d90b39d1b70fd640a6abe4bd2fe688c7","sha256":"8a820f248ff149e8deb270278d007fe922b6c50a0099c3cda1213936e8ffbde0","sha512":"0af0f5b7e67d5f3c58497cf4236f3706cc6afac7a36597de67020afda963b834cdc4f07fdc42929cfebeb2e2d2b66317225a5121ddb49631980b9388f672dcbc","ssdeep":"1536:oJiFd/v7BtIs3b4+xs+BtVsda2SnN2r4RCzTA6VKI5xAKB5cOE/wI2ETHl9b0XZp:oJerb4+xs+Dq6nskqk1I5xBzcx4jETlK","tlshash":"84730264c41c06eee72e09abe49a61bdde046dbcd079d2641ea933a0cdf940f36457e1","first_seen":"2026-07-17T12:50:50.413778Z","last_seen":"2026-07-17T19:20:40.714431Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/codeflag-link.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.088Z","timestamp":1784315999088,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/codeflag-link.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:08 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 20575\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":20575,"size_decoded":20818,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2ede4c4f04b8d4e0a7f3ba17cf7e10de","sha1":"b2aad0fc115b0f5123dafe2ffa827b5fb005c342","sha256":"3603cdff3f7af5e18bc120728099ef179c02dfa4dbf105a51093d5e501ffa032","sha512":"2968df1a3151d4cdde745daa575409a13873b181b27f6af11a70adf9888899c4b4c4ec4631ad825a66afc4283b739036c579ab220b99f0e69218cd42cabf662a","ssdeep":"192:MNfWPseI0uGOq1ha18df0UOu7nV0RucR6exG6:bPseI0XOq1ha18df0UOunV0RlRf06","tlshash":"21921e2ccb6239cbb73f9771277007429f767017a912052cb2f63d952fe10a694a2ed9","first_seen":"2024-02-22T16:27:48Z","last_seen":"2026-07-17T19:20:40.714949Z","times_seen":222,"resource_available":false,"data":null}},"time_used":1117,"timings":{"blocked":-1,"dns":0,"connect":276,"send":0,"wait":275,"receive":275,"ssl":291},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/animate.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.092Z","timestamp":1784315999092,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/animate.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:06 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 80278\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":80278,"size_decoded":80521,"mime_type":"text/css","magic":"ASCII text","md5":"ca763b35dde8eb037a15a37a4a4a4ead","sha1":"96f79daac19b3c1750ce7fcb97c432afb8340e98","sha256":"b1dff1fceb1103ae1939d6f02695597e7724f07e4e6f66f4893a5648ec7066b4","sha512":"a684974dcb845c08125dfe4c640a8d60fd2dbf62c4bf9aeb599b24f7902ed7cbd0a1fae42d53fa37acb157c50fdc0158636fb4b95764f2094fdc6f7c9834ecc8","ssdeep":"384:WQiuHPeRe4cyHNb3Y4P/ezeHVLVNWzWjK1RPclTb+u:XPeReYYSezeRWzWjK1RPclTb+u","tlshash":"08732c7e3992114453270b6583ef0e68663ce56318269ce9b7ce498bdf86f7d23c9207","first_seen":"2024-02-22T16:27:48Z","last_seen":"2026-07-17T19:20:40.715423Z","times_seen":270,"resource_available":false,"data":null}},"time_used":1444,"timings":{"blocked":-1,"dns":0,"connect":279,"send":0,"wait":279,"receive":601,"ssl":284},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/facebook.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.096Z","timestamp":1784315999096,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/facebook.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:10 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 4991\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4991,"size_decoded":5232,"mime_type":"text/css","magic":"ASCII text","md5":"fd24dce22baa30365f7e7e1cd05b2683","sha1":"711eb5c1f2a68d64c8434de4edc01d6b8de0a4eb","sha256":"250240f7d78dfb0d799e199d89956b303a62d28cc1c0db24a514e96b7b6d802f","sha512":"c4327e1d1bc0e5410bdf19b5c4f3309d4519e68520b42ff83863fc548115b6db0fd3128629880e76ffbebf9542c14fcdacbed6a71c2b81a8875a9759fbe1e761","ssdeep":"96:egscteFknaF3eFbFsOFMFpZwsZSFeTFejFCqKFpzJ0XDw:egscteFknaF3eFbFswMFpZfSFeTFejFC","tlshash":"2aa19b972b270548f502dcadbfa51b97720e0863524fdcabbf80755ccf865a886a374c","first_seen":"2024-03-25T05:31:03Z","last_seen":"2026-07-17T19:20:40.715961Z","times_seen":154,"resource_available":false,"data":null}},"time_used":791,"timings":{"blocked":520,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/cargo/wonder.jpg","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.483Z","timestamp":1784315999483,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/cargo/wonder.jpg HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 116016\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":116016,"size_decoded":116261,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1280x499, components 3","md5":"26c3f0fa4ff175f366c0c32345a72554","sha1":"384b7160b8d23c6b7ee7fa7ec221d6159f9d14a5","sha256":"daad9793f7afb0d746759a2ef44037bdae160fd0a4b4bf6e0893fe3db0d738a5","sha512":"367b57bc81a7825754084647c7f2ea8aa4463f3123a5d28d967ac903c5389f3d16a3684903ce067b2e62fdf454568498de560e4224d6447c2c984c289f732a73","ssdeep":"3072:IquqrjNMHc9kgWffBwWj/d7ehDVLxHxitgMoSW3zSmKcDxIthzV98:LuqnNU9gWffKZJVLxHxitvW3WZ+mzT8","tlshash":"69b312ecef22ce80c5da1a34bde1744573991491873b0cf175ae2b69f5827b164d36d0","first_seen":"2026-07-10T08:53:15.949987Z","last_seen":"2026-07-17T19:20:40.716488Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2178,"timings":{"blocked":1905,"dns":0,"connect":0,"send":0,"wait":272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/0.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.525Z","timestamp":1784315999525,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/0.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 18226\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18226,"size_decoded":18469,"mime_type":"image/png","magic":"PNG image data, 480 x 480, 8-bit colormap, non-interlaced","md5":"04aa6ec64ebe4295485f218fc30b50a6","sha1":"5f1aaddc5b4a63e7add38f06f87a8581c1974998","sha256":"bf0d0d14ad8531f8702d7578beefc2a60cc3cddcefb52b765c322e2963308d62","sha512":"3c3b4fcbf9bc1d33de44c0dfb00731d5e500651309d24381d15ef8aee43aea038b4c9d81549818467a7d4236b9455c24d8839b99fac370a383cb90a4d6841353","ssdeep":"384:i//fWCsgvskGpn/vW3TwCm4AF5KbuiwYgipbwLfTuUzuqPi5XD3miku9W:i//OOv6p3/msWbwLfTbzuqPiMii","tlshash":"5082c0a23bdbadf8e9ca2579717bc081d6ba8cc030516a8a45b5bc8953306642543987","first_seen":"2025-04-08T10:46:38.476307Z","last_seen":"2026-07-17T19:20:40.717302Z","times_seen":68,"resource_available":false,"data":null}},"time_used":2249,"timings":{"blocked":1977,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/2.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.590Z","timestamp":1784315999590,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/2.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 15294\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15294,"size_decoded":15537,"mime_type":"image/png","magic":"PNG image data, 556 x 543, 8-bit colormap, non-interlaced","md5":"7cb34961c5da7be99d0b3cf3d2394892","sha1":"ba5a9b0c4c3d916b65c30fa1c560246e13ff122e","sha256":"5ec6dc9824138a6a66378b8c6de830e704fcf4a0b28911c1461395d8338f2e30","sha512":"4bff6da31015e023fe4a7eb55bcbd3c424f359bc12c6307240f018930bef5a96ce5b8ff9326b134c20f4d5cce047c098610c984f540f524d854babf3098f96dc","ssdeep":"384:lj8mHIdduiqZ48Td17WAirsD0N6if0wVUkU+OV:GmQduiqZ48Tv9iGifFVUkhS","tlshash":"fd62cf9bd9538e7380930f1843d9f738ae87a46c7a25d08afd06f85d109e6d06009fcb","first_seen":"2025-09-20T05:43:57.426849Z","last_seen":"2026-07-17T19:20:40.717784Z","times_seen":28,"resource_available":false,"data":null}},"time_used":3051,"timings":{"blocked":2780,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/footer.jpg","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.597Z","timestamp":1784315999597,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/footer.jpg HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:45:14 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 154582\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":154582,"size_decoded":154827,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2209x3264, components 3","md5":"ffc5f7c6320b02bfa9b6bdf9b3d0eab9","sha1":"07f90015eb51bb5d54476a4b9284bc199e1e7958","sha256":"c38fcceac2d57d6b3e0b926b63c18b2534b22582a5b23dd32f8bc99e718d5958","sha512":"353fe0738023f34a6f881e6b004685fe1b41b30040fd625927c5b73ad3837241d951fedef6d904693df91c04a8ef96234843d1968dfd9eac0f2816d146b00a70","ssdeep":"3072:9hr/5iONQFJxZlbhRNctsU4uka7AkXa2SEEmyqljNBkj:UvJx3bhgtsU4QbXaB1Qjk","tlshash":"e7e302c62778cee3e5e195766c8e3c4efba1ca201bb887bb6914d2c0455b78939c3521","first_seen":"2025-04-08T10:46:38.457324Z","last_seen":"2026-07-17T19:20:40.718302Z","times_seen":56,"resource_available":false,"data":null}},"time_used":3870,"timings":{"blocked":3323,"dns":0,"connect":0,"send":0,"wait":274,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/scripts.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.736Z","timestamp":1784315999736,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/scripts.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:02:56 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 9796\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9796,"size_decoded":10044,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"60118d7019b032dd118a781698a7e2f7","sha1":"d20aed21b7eb6b93310be8e1de25f5d64fab4ed4","sha256":"a083a3f3a3a9805322185b9ecf9066c2aa3a38dfc683904ad5396b86d3cf4b7e","sha512":"8e908f3b94e6387bfd20fdac5513485264cd0dab7918d243aa3d520697534e05cd5d7d46423137a0a04c85d4070a056603e7266ad957196e21f240d15aa61c7c","ssdeep":"192:jak2ExGnwSaAWP/dlj3VM+lWiDFiSKWij7Jy1ihyTHvDfH2AuNGuKF:jakZxAbWHdlj3VMqWi5iSKWiXCiCPDfd","tlshash":"c312cc86b5d51c01a47b78b6123f11587a5c8447250acf09fca89aed2f21e27ad73bcf","first_seen":"2025-04-08T10:46:38.488917Z","last_seen":"2026-07-17T19:20:40.718825Z","times_seen":80,"resource_available":true,"data":null}},"time_used":1078,"timings":{"blocked":804,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/twitter.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.097Z","timestamp":1784315999097,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/twitter.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:20 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 7116\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":7116,"size_decoded":7357,"mime_type":"text/css","magic":"ASCII text","md5":"54b0095a7672e6b73d5e76df043962c4","sha1":"45fc740de06e2680246d692c5f30d5d7a12a7e66","sha256":"c0b584c408f633822d68fb3cc90163ed201f788aa74bbe1a35d5764a55d21b5f","sha512":"5991e8669e054a697c4b3fe37a2cc9760826883913c8010595ae2bc326b09b374f9d84cb448ddfa4d479d55790fa827cfd34bddae9d853540fb376cf00f3f056","ssdeep":"96:/aVJ6M6X4z7RPnk4sOFAMkErO8KZfkli6AOYNHA8VoIo0P:SVYrW8ZOFA7ErO8KZMli6AOyAWoW","tlshash":"6de1eea79f261508f502e8f8ffa66b9666094013534fcda3be4c7618cfc66584bb274c","first_seen":"2024-03-25T05:31:03Z","last_seen":"2026-07-17T19:20:40.7196Z","times_seen":148,"resource_available":false,"data":null}},"time_used":1080,"timings":{"blocked":791,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/uc.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.519Z","timestamp":1784315999519,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/uc.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 01 Nov 2025 16:55:18 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 11373\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":11373,"size_decoded":11616,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit colormap, non-interlaced","md5":"946bdad02587d36cfac8b0063a5ec4c1","sha1":"bad86555f531c44d3061291ecf01c647cfc5eb2c","sha256":"e4b70ad98ac90cb153f9df3b0ab86540315f4f1a4d730ec586d7e7e3c4da35d0","sha512":"5092bc1b7a20ce464762e7547d64e3055e627cec73b335799456b5e691d29f15b3e665369c8d5d86990745471adb1a34e240da3e01bc7960dc085ca1755e71c1","ssdeep":"192:4Ix8JC5eKNidsqxHpvaRAJMXiE6kzt8bn4fTKfBmcZrPggsHbBz87C:iEeKN4S6k60LWrPgt9R","tlshash":"4d32bffc1f1079712ae2e64e5d2a5a1445a3d7cacfc7170abb3ef2ab4512bb20364171","first_seen":"2025-12-24T04:13:51.964981Z","last_seen":"2026-07-17T19:20:40.720106Z","times_seen":18,"resource_available":false,"data":null}},"time_used":3576,"timings":{"blocked":3294,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/6217705605191898301.jpg?m=1783171299","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.554Z","timestamp":1784315999554,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/6217705605191898301.jpg?m=1783171299 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 17:49:38 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 04 Jul 2026 13:21:39 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\nage: 437422\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BMLfAb%2FT36gTSG6Vr8xkBNmtZdlSj%2FUGWC2G1hPzYWIwqtRUkehpl8ziK1JqPwWDqdzIKlSg41ZcGUhiolYW840sI%2FFOClNaD682IKe9f09%2BbGDih93AjbaILQtK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2e5696-OSL\r\ncontent-length: 88923\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":88923,"size_decoded":89682,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 822x267, components 3","md5":"dc15ec2faef466f9050465dd1a552174","sha1":"5d9a9d0c80de2611f4fb7182aa7f77606f6fde38","sha256":"19dd3f3bf819aceed886c7cabb59488c565ccc525b45e52ff38bd3c71f00a9a5","sha512":"a5bb77dd53809e023ae24e789f8c6a96ed0008b3f93a6108afdecbdf6a94c8ffd9d589222a398cf4725a4a13ef07fef2762130d25866ae2f37604da4b8406db1","ssdeep":"1536:O70TY2QJjfbEXNRx3cLwxqeYFvUkP4gxFYKGlrIrYAdvbdPyqdlG9rjM45adW2zV:wH2CvEO8RYFMAhvnGlrInJbdPyqdlGrk","tlshash":"6e9312c52b4437f2d4b7d335761e829fb684fec74aeec9128a6f4387b44a18e1548760","first_seen":"2026-07-10T08:53:16.015461Z","last_seen":"2026-07-17T19:20:40.720611Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":1230,"dns":0,"connect":0,"send":0,"wait":23,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/icon_2.jpg","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.601Z","timestamp":1784315999601,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/icon_2.jpg HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:02 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 41568\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41568,"size_decoded":41812,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 554x554, components 3","md5":"e460815c4b5fb5da7287303d61856a57","sha1":"0d02c20157cca40c3ef03b3ab9aac6045912321c","sha256":"d9d1699f5afeca01d35e22fbdfcdd3178713353150a16a51a54887e914388582","sha512":"4ebe9bb1412cef11d59fcc7aa132e0c7594e9b3371fd024459fa2594a7281ebdd44a53d95df513b83bc7b404877945e329ba6eeb65639f0ad6b39c3ce78b46d6","ssdeep":"768:NEEPzzXaDYJ3ZsiE8CQuw670iAML3stgqtqUEHaW6Zi3UN:GEr2DwZY8670TMQNEOog","tlshash":"d713f128c34c4333f31257e995cf4a9a2778ee76ab8e22e77c2168dd017a7784e51c94","first_seen":"2023-06-20T14:57:34Z","last_seen":"2026-07-17T19:20:40.721139Z","times_seen":134,"resource_available":false,"data":null}},"time_used":3735,"timings":{"blocked":3458,"dns":0,"connect":0,"send":0,"wait":276,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/icon-facebook.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.689Z","timestamp":1784315999689,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/icon-facebook.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 2610\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2610,"size_decoded":2852,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 4-bit colormap, non-interlaced","md5":"e2edcb11b1fb0ed52ad1d401db6e8d0c","sha1":"c6b6b0a14130197135419556e9bbe2693bd1ea02","sha256":"77a80237040f333378f6d53a2f873fd5662c7c06d9f374468bb7b0ef4b84ed43","sha512":"12c292ee476f994796a49f91984fafc3e866bcc79d6a357128c19737286ad2cfbd506fb0a8a6fbae49c5d8fe88469a59294a9e996920cbfda626bbdb1f056543","ssdeep":"","tlshash":"62514de4d14cb97ee995073270d3e074eda70e226d700282bec9ed12eaa6d43b63600d","first_seen":"2024-11-12T17:04:27.205658Z","last_seen":"2026-07-17T19:20:40.722162Z","times_seen":116,"resource_available":false,"data":null}},"time_used":3843,"timings":{"blocked":3570,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/twitter.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.726Z","timestamp":1784315999726,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/twitter.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jan 2025 13:36:28 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 3405\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3405,"size_decoded":3647,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit colormap, non-interlaced","md5":"cf321985f609b4ca6ca281005001a0a0","sha1":"220f03be612ac92c47290d2818ab8a6f2d49ae9e","sha256":"bad8a34ca2a283e0a967ef3828bb64395b7c40cc88ac4f7cb176cca4e166660b","sha512":"344d01a2e0a7087bd77f438ca0cd8c1f2e339479799394e90b82deb8338fc90c779c0d469ab5afe265d8edab55dad4cd012c7ab7ca9099b990be2fd456031820","ssdeep":"","tlshash":"0c61198f24214232c811fbf94fe059ea9433bc119be5d465af41eb610cec69984aff30","first_seen":"2025-07-12T07:19:04.979756Z","last_seen":"2026-07-17T19:20:40.722647Z","times_seen":66,"resource_available":false,"data":null}},"time_used":4142,"timings":{"blocked":3866,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:01.613Z","timestamp":1784316001613,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nContent-Length: 355\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":555,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-07-17T20:50:35.520008Z","times_seen":45788,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/loader.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.093Z","timestamp":1784315999093,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/loader.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:03:14 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5907\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5907,"size_decoded":6149,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"5e45b9f875c2c76883f65660aeac3c62","sha1":"1bed11b55d8606af61d7091293672d6bbef60190","sha256":"123dcefbcb4cee978079f58af16e2ccebe7545eca71c801e6550899fe65f5cab","sha512":"dca8572e341d0e9687a70a2627d2ea0556a67be51294ae15aac0eaf1e65db40ef11f13ca481dcdf39c93ae6fd8de72d42b449ce34fc379b4e8aa24f4e648b4cf","ssdeep":"48:zAOJBWJ4s5niyu/otjrjYpW1nvnQnX1nvnQnkNFLnvnQnkQPQvnQnkaPt0NQnk6s:zl7WJ4gnic3Y5FaPFaM9niv/46","tlshash":"39c1841a08e349cd19aa45340e451e36d71e8423f56b3c63bacca1c4cffaa8a72c7dd5","first_seen":"2024-03-25T05:31:03Z","last_seen":"2026-07-17T19:20:40.723713Z","times_seen":221,"resource_available":false,"data":null}},"time_used":820,"timings":{"blocked":-1,"dns":0,"connect":272,"send":0,"wait":271,"receive":0,"ssl":276},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-12_10-50-45-584%20%281%29.png?m=1783828650","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.521Z","timestamp":1784315999521,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-12_10-50-45-584%20%281%29.png?m=1783828650 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 24909\r\ncache-control: public, max-age=604800\r\nexpires: Sun, 19 Jul 2026 11:58:19 GMT\r\nlast-modified: Sun, 12 Jul 2026 03:57:30 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 458499\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iE%2FoAZ5rOvcCefpHe4Z1v0fkd3jO7U1CYEgyautwz7qxZnVdT6yYXEDzT6Si%2BZeKupdzZ6bd1kfdrSTNGIKW7HHy2FhF9%2ByHlZ5pNU%2F5RugyVhIvTFRAyyzFiRp6\"}]}\r\ncf-ray: a1cb99f70bcfb4ee-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":24909,"size_decoded":25637,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"8c30a3e94dbf32da62e4f8f43b26689c","sha1":"cb7d0884cecc32917ca5b3a04a6e6727f34b4bf4","sha256":"54e4bb5c12b6a4d2d477f1cb679bf3e82bd2281ece39f43b8b0bb7683cba33ad","sha512":"7f91e6dfa8dd05886efd68673a272340111ef78efc41e3c57ab17ddca095ef3b72dfab834e536d4e3b3cf6e7e3f6f1eef7070f9865ed925ca7b1d2423bdb19fe","ssdeep":"768:JJBcOxcUZP+PDTxUhB+oKzzxwwdA6lmjHHXfu:1c5UZP+PDW+5Xnlmzfu","tlshash":"77b2e1ec15666c34e487261c2b7a9fb0dabd98e9fe115c78d001093c4ef17e1903af4a","first_seen":"2026-07-17T12:50:50.364282Z","last_seen":"2026-07-17T19:20:40.724207Z","times_seen":3,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":272,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/thumbs/Picsart_26-07-10_11-39-02-935%20%281%29.png?m=1783659230","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.531Z","timestamp":1784315999531,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/thumbs/Picsart_26-07-10_11-39-02-935%20%281%29.png?m=1783659230 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 10 Jul 2026 04:53:50 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600669\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jb64ai92qx9IwHnOP0%2BCBwF1FUErATeP9X3lQ3e9bulLvBtYOi8oOfv7Y7GIvF1zjXcBN%2FZCPQDGXGLt8DASDBFl1Jv1iJtRA2a7ffYb2LhaY7qrZqLxxeRIyCAg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1cb99fd2b2c5696-OSL\r\ncontent-length: 39149\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39149,"size_decoded":39895,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e982eee9c375a5a9f15d9479d1113dcc","sha1":"2bd767a7d01dd47ed2883e9be8fe622fd081d3df","sha256":"4c0dba05b2dea511ce63e8653f233494555bb80fc79b779ce706c70cba27462b","sha512":"e688a306677af6877ef594881f96cb920484752e5bfa9e40ee64252b1dc53e0dce6cca0f040ff9716a1f58d38593e085d32fb99ec9f3e0bf7e37ddfa2c8e60d0","ssdeep":"768:62eWgiiZVmP/hco62RfCptt8/GGSwZRYNODP3ExVWpx:7ebpmHu4Ct8OG5RsODfwyx","tlshash":"4f030136657c240d1f487adf6708d99764b34f1a9446eadcf24f1d32b2844e215ea741","first_seen":"2026-07-17T12:50:50.367449Z","last_seen":"2026-07-17T19:20:40.724767Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1264,"timings":{"blocked":1233,"dns":0,"connect":0,"send":0,"wait":21,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/gilts/1.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.576Z","timestamp":1784315999576,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/gilts/1.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 34083\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":34083,"size_decoded":34326,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"f2003d3274a24dac6b3ee82ddfd7ca23","sha1":"6dd3d687f9a9c8b9db6da853540814784b2d53dd","sha256":"68be16d343c5cb0133901dc12e46c5fd9e0d1e6af70704c34651536aaf53c65b","sha512":"0be9988392c6eca236671a89e39e1a32ffdea2a5e94617c66706512aa5b7325e9c8dcf18e2f76af7b10e212258158b05d4f31f74e7d16514d8b65a4c378f5cc7","ssdeep":"768:QPLRMWsxzTEGYi+rDkYbw5Ba29WJ6lEf9DO+0Yd:u9MrzJ5+rDkX5o//9q+0Yd","tlshash":"d3e2f180e79df215bc4fd43ba288aa3fd41058f1ff17804139d79892ac766d82896c2e","first_seen":"2026-07-10T08:53:16.035086Z","last_seen":"2026-07-17T19:20:40.725308Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2685,"timings":{"blocked":2399,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/load.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.694Z","timestamp":1784315999694,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/load.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 1216\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1216,"size_decoded":1458,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit colormap, non-interlaced","md5":"a69fc2ed26ae309cf286cfda8a4e24e1","sha1":"67737d61d5fda0870a05f9348f3d39bb7a2d7540","sha256":"811d969caab65f3cf1f7c176d716925857c638b13aa3bce44006b00eba3fbd8e","sha512":"53eb8153cad4d6f37bd6b3668f872062833bb1cf44083702d879c87e245949eb66fb089083d62757b6d5d5bf79cbdefaee463b330c53e530bc536c529d5615ff","ssdeep":"","tlshash":"c621a777e5f9b0658a817c32f639b2b062544d884cde11096f2af3b10c7b54a250ed1e","first_seen":"2025-04-08T10:46:38.439616Z","last_seen":"2026-07-17T19:20:40.726183Z","times_seen":79,"resource_available":false,"data":null}},"time_used":3957,"timings":{"blocked":3686,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/close.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.713Z","timestamp":1784315999713,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/close.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:45:14 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 439\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":439,"size_decoded":680,"mime_type":"image/png","magic":"PNG image data, 43 x 45, 8-bit colormap, non-interlaced","md5":"815975de405870b94446a7af9b82c10a","sha1":"4ea59a907457691ba14f134f551a07bc041b7241","sha256":"d9b016e27e8a4af0800e87b4ea168955be7030b21cc06bdbd92ccbcc83f665a8","sha512":"d7fcad14d34353cb1835362745baedd38d73136820058b328bb546dc3c2ba592a13d984fd4696ae534b729fc9bc34c909f08dccb0f6d35c01e8cd7903949539c","ssdeep":"","tlshash":"30f0f8fde32a29b6fe1114b26439113df1609caa1d07de199823307019f93e1c294ac3","first_seen":"2025-04-08T10:46:38.43083Z","last_seen":"2026-07-17T19:20:40.726778Z","times_seen":82,"resource_available":false,"data":null}},"time_used":3982,"timings":{"blocked":3703,"dns":0,"connect":0,"send":0,"wait":279,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/assets/kotak.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.715Z","timestamp":1784315999715,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/assets/kotak.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 29 Mar 2025 17:58:04 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 15972\r\nKeep-Alive: timeout=5, max=89\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15972,"size_decoded":16215,"mime_type":"image/png","magic":"PNG image data, 396 x 396, 4-bit colormap, non-interlaced","md5":"a0e9cd1d294bc2e59ab31ceef822ef6b","sha1":"44668ee5ad88c1516e64810f671e25996863ecdd","sha256":"00b3061e1a8d6e80b78a45d5d9bf1e8a91b6fbb351544229272658aa0677fb9f","sha512":"c7eaac898b957901884e8fa08ead6a62e37091d634ae2a821eccbbacd78067c9c80c11c8c4e0373ff93ed524c45f959417a39ba3f3da597903e08a4fd6d9e33f","ssdeep":"384:ffHxGVdWos+qrtrY18FyaDyQfY4fGToA0RP9wKzauc:HHwT9GrY18FwtToALKz2","tlshash":"a172e1a797b8d7f4a3921c9234790ef4cd5e72e4589f2edf029e06184cc245f4d472a4","first_seen":"2024-04-30T06:02:51Z","last_seen":"2026-07-17T19:20:40.727281Z","times_seen":76,"resource_available":false,"data":null}},"time_used":4014,"timings":{"blocked":3742,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/vip.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.734Z","timestamp":1784315999734,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/vip.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:03 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 14 Dec 2024 08:31:50 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 21584\r\nKeep-Alive: timeout=5, max=88\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":21584,"size_decoded":21827,"mime_type":"image/png","magic":"PNG image data, 1280 x 180, 8-bit colormap, non-interlaced","md5":"894d8e40fb1ec55bc12f99571a65b6a4","sha1":"5a1a16a1ba138083b10646f24acc9a4cb8261d0d","sha256":"f5a1c134138e7b54aa95d10277c00fae61a93a2352c39b542506803696e6bf7b","sha512":"372de36e98b69470e90ff12bd6cefb3046181a252b6c238eba4c3fd3927c563a65e081d6eb2f69f515ccd46aa5d67f9eebd32c8782fe838aeeb3ed6db8d42d1d","ssdeep":"384:bFDL6IlLt7h56eBTHvcGEvCIHGCvXjUmTGK0xQkILf98T7AO:bfAwPZEbBLTxdkI58TT","tlshash":"47a2d158d06800c5ef35e0e6a18b9c26d7905fe4fb706c1f6d9a62b5c1ff2a48e940ed","first_seen":"2025-07-27T06:58:26.704133Z","last_seen":"2026-07-17T19:20:40.72774Z","times_seen":42,"resource_available":false,"data":null}},"time_used":4267,"timings":{"blocked":3995,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.388Z","timestamp":1784315999388,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://mail.itsmebay.rumahsakit.de\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Fri, 17 Jul 2026 19:19:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 5845\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:12:09 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4%2B9fiDG%2BHezWTK%2FJSaeqrJc7YTg1Ycx56kseNy6XCRxsX3RjUiA2Um%2BIF4C1oe%2FCDfkmc59%2B3yNO6siNtamM%2F%2F8qFeGM1M%2FUf1tAI7WVUf7DAwoJBkSbPEOw%2Bf4MY7TFfhoviYXI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1cb99f44dd956b1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":70815,"size_decoded":6849,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"e9365fe85b7e4db79a87015e52c3db6c","sha1":"2e2b5eb6e08f0f3d11fe0ada97c962a23ba6a0d9","sha256":"dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56","sha512":"ad142d178576c2d02f5eca2ee22500b369171e2dcb8fd344ef1251efb0c4ec61ecc6063d4535b2f77773317803206f13a224530f8e55b0335d4e251a80e15e64","ssdeep":"768:/KvcqyF7I4rb84dLM+JKvcqyF7I4rb84dLM+k:B/nLMu/nLM5","tlshash":"40631be8e80900d26fb1cc03ef62b7ca1685f0a3f9d10dd8f17a998c29d16551597fab","first_seen":"2023-04-05T03:25:07Z","last_seen":"2026-07-17T19:20:40.705366Z","times_seen":10605,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":2,"connect":13,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/cargo/unknown.jpg","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.485Z","timestamp":1784315999485,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/cargo/unknown.jpg HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 45125\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":45125,"size_decoded":45369,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1280x499, components 3","md5":"27efaddeaec7fa01e6d0a693eab4e954","sha1":"c586e27ac486ec396fdfef5818f00ade9e212ea9","sha256":"a53a21c3c27ea6b08b17c62a832e554b93305171b114b63560847d31f1046fbf","sha512":"095580100377b7fec15c9346dd9b89877a1cb077d6d332a0d4d421341e4bfeed2fcc7a1ff6277151336ae834eb9819406e93501b77691668f364739f952de6aa","ssdeep":"768:9O8T+qtu0Zs3nMK0twqBMUHkCHlLLD33WxU3lwgXQEPRKBqVmfvD/I:88T+Ku3nMHtwkvnLLDH0iwenPYBqVmf8","tlshash":"cf13f13aab246050ff36add3261117466ccece5807044b67a01ca7e2d3a6ce3b5e4f5b","first_seen":"2026-07-10T08:53:15.990009Z","last_seen":"2026-07-17T19:20:40.728231Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2186,"timings":{"blocked":1906,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/3.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.558Z","timestamp":1784315999558,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/3.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:20 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 170115\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":170115,"size_decoded":170359,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced","md5":"1045566bc00fa05653e330aaf20b8800","sha1":"afcf20048c9f97505fcd839c54ad0cac4d1bbb65","sha256":"037ba48dc3384b7f01454d4dbfa448924adce1c2128a87ac726f20027c1c8332","sha512":"b435966b3b8e8c6ea27c9737c539ce2e49fd3cbc0c2ed84573b8d1b77acf53537322ada75bcb6371275ab41ac9601dda2c21847d829ac0b697e1e77c38c8d4e8","ssdeep":"3072:xmSbtnqqvOVc2hEu1tIsKtx1NgsVUfZ6YsMcXoY5HTdgMXXqzWr:xZB9Mfb1tIvtX+s+fxsMSnzd/XazWr","tlshash":"4ff3138269291c727df3323391b5499bcccfbc9267c6ba6a45987cb4cad058045d2f4f","first_seen":"2026-07-10T08:53:15.967606Z","last_seen":"2026-07-17T19:20:40.729123Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2703,"timings":{"blocked":2136,"dns":0,"connect":0,"send":0,"wait":283,"receive":284,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/mumi/6.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.574Z","timestamp":1784315999574,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/mumi/6.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:01 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 04 Jul 2026 13:14:49 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 68063\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":68063,"size_decoded":68306,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"d6f42eab8d6d308f54125b6ec4436c82","sha1":"c79e2f962b8dee08853ef44b5411fd0999e8e3da","sha256":"d126d527c361d87612937e0bd13bc8db48857f9cc341662e12763aa81918e243","sha512":"4bbe716b5a9a557dbd3e4fa02f33d033068facf53da064e0982ba8f50601edd891f05b24995344cf959398db1b2e9814ba4c2fabeb25c7cf8fc97f0f5b482e3b","ssdeep":"1536:la3Hnf2VvuyUf061kgzhYzggXs7uIL04X:wXflyd61kg9YzggXsVQ4X","tlshash":"9663026c4ed65320ed3f44443035f2ede55c54a87589b4486727b63bb19ad3b0f40bab","first_seen":"2026-07-10T08:53:16.06483Z","last_seen":"2026-07-17T19:20:40.730103Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2840,"timings":{"blocked":2283,"dns":0,"connect":0,"send":0,"wait":283,"receive":274,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/lenz/codeflag-link.js","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.733Z","timestamp":1784315999733,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /lenz/codeflag-link.js HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:19:59 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:02:48 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 462811\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":462811,"size_decoded":463061,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1591)","md5":"5674ef5a95b8f48ba0a8405d056ba0ce","sha1":"9991445667304928434eb128a38ab05902c38391","sha256":"595f1377e816f8f8f50b3cc558c4cf3f4a83a20ac45675b3e558b6aed1d0d42a","sha512":"5a3a0916c466dab4209820c2270e23da544432c26af5d6c6baaea7ec1b5baac0cebbb764a1afb48aea2fe55d71ac9b32f1141e78d86ba6f4655d3c67cb7f60c6","ssdeep":"3072:CsJjxDkcrFNjeNkWGlXQlXaDiNQOdrZXCiu:C8xAcvyOxlXQlXuPFiu","tlshash":"5aa4f092d6216b16f750b63841a67d89298c59db8cbd7d8876ed9b8c0f2c0be4f7c10c","first_seen":"2023-10-14T05:17:14Z","last_seen":"2026-07-17T19:20:40.731067Z","times_seen":489,"resource_available":true,"data":null}},"time_used":823,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":548,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"im.g-o.lol/var/albums/Picsart_26-07-09_20-38-26-427-removebg-preview%20%281%29.png?m=1783604383","fqdn":"im.g-o.lol","domain":"g-o.lol","tld":"lol"},"ip":{"addr":"172.67.161.231","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.845Z","timestamp":1784316000845,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g-o.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Jun 2026 10:01:31 GMT","end":"Wed, 09 Sep 2026 11:00:16 GMT"},"fingerprint":{"sha1":"1F:E0:16:D3:90:31:23:23:64:A2:20:F1:61:5F:BC:2B:8C:F1:D1:51","sha256":"14:26:3C:16:0D:D0:DB:9B:7B:27:FA:F1:FE:5F:5E:CA:BA:B6:39:13:78:31:B1:A4:2B:E6:35:C8:F8:DD:3C:A7"}}},"request":{"raw":"GET /var/albums/Picsart_26-07-09_20-38-26-427-removebg-preview%20%281%29.png?m=1783604383 HTTP/1.1\r\nHost: im.g-o.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 17 Jul 2026 20:28:53 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 13:39:43 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Fri, 17 Jul 2026 19:20:00 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 600666\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4fD%2B6imM5tMcmkQaVtWyBHBRlv8Zow9ldpIyq1Qkzyw%2BU34IEy2VstxWu9mR7Bg3N3LZHtitYrYVTLsEpIzYLUuNnul9oSL1kr1DuYA70diuUNpsY7TzPlCrfy06\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1cb99fd4b325696-OSL\r\ncontent-length: 65259\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65259,"size_decoded":66005,"mime_type":"image/png","magic":"PNG image data, 1581 x 158, 8-bit colormap, non-interlaced","md5":"d47a4a7c44126d041aace08474f18acd","sha1":"55655fb24c34130b7eab951dd2656f9f443e37b7","sha256":"7b8e1e5dc12c8c718aaab56363475c6c336c3ba2b411f778a83eb731fc7e9e24","sha512":"ab6123eed206de594cd03d6b7cd7e104946b551d7ab7a65206d064f56516a400c5ba83560603426d9e377e2efdf6e29a4798ed2eb14f1e83443a6410e14d4542","ssdeep":"1536:Yfa9la0UzTRUCX1CxuVCxAdX2RrLBGPoaYOFAovEkxJRRqt62XYyaFZCfG:TaRHRWx8dX2BFao3uAo3xNMIlC+","tlshash":"c65302a3473c4baf3c9e595f6ec41a4c843dfdcd66a2ab673f78355a26716808613044","first_seen":"2026-07-17T12:50:50.325664Z","last_seen":"2026-07-17T19:20:40.71392Z","times_seen":3,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/media/kinnon-stop.mp3","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:00.985Z","timestamp":1784316000985,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /media/kinnon-stop.mp3 HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Sep 2024 03:12:36 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 9065\r\nContent-Range: bytes 0-9064/9065\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: audio/mpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":9065,"size_decoded":9355,"mime_type":"audio/mp4","magic":"ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio","md5":"51265f018ebafa70d91c30f4fc4baa2f","sha1":"b77281529cbe4ad8bb1a9bd8c972ff2d06e5ed51","sha256":"559a82fea775757c221dc15d7598a584d16c6750ddd7c05d7096107f9b8156cc","sha512":"023d15891c52c3d351df72ed591c7e626179adfb7ae11c49814705c8b581ea3f47e9c1cd5a1026060c5c488e455a97021f2c7ad741ad6f2016de5b394524d61d","ssdeep":"192:WWXEKrwn5BGky7ywIgX1JD1Nkk/fgg0tEHkNuzDqL2a:og4Uky7RImHkk/dZEgzDqaa","tlshash":"ce12a00e43313e2ed3949e3c114e1bc3b792e5f49baaa95bd4c594084e0ea40df794d7","first_seen":"2024-01-05T16:39:52Z","last_seen":"2026-07-17T19:20:40.731549Z","times_seen":140,"resource_available":false,"data":null}},"time_used":1938,"timings":{"blocked":1664,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.pubgmobile.com/common/images/icon_logo.jpg","fqdn":"www.pubgmobile.com","domain":"pubgmobile.com","tld":"com"},"ip":{"addr":"95.101.10.40","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:20:04.181Z","timestamp":1784316004181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetv.acc.qq.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 31 Mar 2026 00:00:00 GMT","end":"Thu, 15 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"23:67:83:42:CD:0F:6F:1D:26:7A:68:24:DD:55:3E:E5:DA:02:47:12","sha256":"43:D8:C4:26:07:A2:1B:BD:BB:C7:0D:D0:5F:D9:84:BC:1A:F3:DE:76:68:33:FA:FA:7E:3D:6F:D5:69:52:39:0E"}}},"request":{"raw":"GET /common/images/icon_logo.jpg HTTP/1.1\r\nHost: www.pubgmobile.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: image/jpeg\r\ncontent-length: 406248\r\nlast-modified: Tue, 12 Nov 2024 03:01:40 GMT\r\netag: \"6732c514-632e8\"\r\naccept-ranges: bytes\r\ncache-control: max-age=155\r\nexpires: Fri, 17 Jul 2026 19:22:39 GMT\r\ndate: Fri, 17 Jul 2026 19:20:04 GMT\r\nakamai-grn: 0.240a655f.1784316004.1559e26e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":406248,"size_decoded":406589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=1], baseline, precision 8, 1024x1024, components 3","md5":"f39468301eff4078e639c7d9e838898f","sha1":"2b2c8cda2d81199889e1e66371f71b027c5c286b","sha256":"4b08d577f3c332488af8d067948bd6515d4d0d491fd705ee23b7485cb0a64005","sha512":"e65a0fee87c4743c9317b0bf62dd7f86f9366155c64eb959b64d4425eada2d524634a96d358557e471f3e639428dfdecf44921bf0c6d6f6905ff439d5b2cf4e6","ssdeep":"6144:/+NqPRRWmq5yQGwQxNfvViwFuC1ijzeWUJ/5FnnvTSqKVVG9RJSKfW9/DxYTXNjl:dPRRWmk6EwuPaWUpvWpG9C2WcNh","tlshash":"c884234216dd3873d7e2e53ab490960c3ac9ee4f0e59072bb4dbaece5ce25d3485a052","first_seen":"2024-11-18T20:57:47.597476Z","last_seen":"2026-07-17T19:20:40.732052Z","times_seen":176,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":195,"connect":1,"send":0,"wait":15,"receive":6,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/lenzz.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.111Z","timestamp":1784315999111,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/lenzz.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Thu, 18 Dec 2025 02:19:24 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5360\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5360,"size_decoded":5601,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"c25fcb475429c38dc845a1900a13517e","sha1":"5442935209d03b20604216fe043ef943e773e4fd","sha256":"791b93d3074fc80c6234758b9931923b9bf652b84fb260f6fda9912df7c59d6e","sha512":"d5d47023602643a1efe64453c3af94fb8d15bbff37300f4fb6318f1c65659574e550ee04d94fbd30cddc3387e989325eaa78f4cd2470b3a2d3c4f4fe79acd45a","ssdeep":"96:l+PuwQc/zJIvgbxQ2PKlyHpv/D1VlrpHQNCYPX+9elNd9PXAVmHLh0bb4GqMz:ZaOIb22PACj8+9elNd9PKiqv4Gtz","tlshash":"d2b121299a4d508df215a8fefb717ba9ff5408a3c74f43b4b1f07504ca856642a323c9","first_seen":"2026-02-05T09:20:42.021161Z","last_seen":"2026-07-17T19:20:40.732582Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1422,"timings":{"blocked":1142,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/css/loginx.css","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.107Z","timestamp":1784315999107,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /css/loginx.css HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:00 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 07 Mar 2025 20:59:30 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 4314\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4314,"size_decoded":4555,"mime_type":"text/css","magic":"exported SGML document, ASCII text","md5":"753c7fd6762bb64801a6b2685c312a25","sha1":"3f9d8b016252c487a1c6aaef60b33d842f2c30cb","sha256":"ca7bd9293aa9c20764d1a394159667ef9d826a7912ade65cdc67f8183578120d","sha512":"dcbca32f56d4675e245d425ce7cb2b658bbb68fb0244350b748c76c68b0f7d26fb1d817a572ba0a745f37c613954aadb8b338f6879c84e88ae01c719165b47fd","ssdeep":"96:KT4jodQLFzjddSHJ8Y8vqOFWEpZvNSS/uRIa3ev+o/olojX34PinJrU:KT4bFUWzykrj/s3G+o/oloj4PGJrU","tlshash":"bb9112a367a6700cf44bd8a9e6621b59631e1443678fde7ea6e1309cdfc45d0463378c","first_seen":"2025-04-08T10:46:38.475316Z","last_seen":"2026-07-17T19:20:40.733527Z","times_seen":44,"resource_available":false,"data":null}},"time_used":1363,"timings":{"blocked":1088,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.itsmebay.rumahsakit.de/img/lenzz/wonder/4.png","fqdn":"mail.itsmebay.rumahsakit.de","domain":"rumahsakit.de","tld":"de"},"ip":{"addr":"103.52.114.215","port":443,"asn":136052,"as":"PT Cloud Hosting Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.592Z","timestamp":1784315999592,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.itsmebay.rumahsakit.de","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:04:01 GMT","end":"Wed, 14 Oct 2026 11:04:00 GMT"},"fingerprint":{"sha1":"44:F4:5B:17:CA:B8:41:B7:4D:A5:6A:81:C4:17:6C:1A:3A:4D:57:5E","sha256":"A6:F6:20:5B:7A:97:4F:01:58:3C:50:8B:96:0D:C1:40:F9:76:FD:9A:B7:55:E0:E5:80:AD:B9:72:CC:2F:85:10"}}},"request":{"raw":"GET /img/lenzz/wonder/4.png HTTP/1.1\r\nHost: mail.itsmebay.rumahsakit.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 19:20:02 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 27 Jun 2026 21:17:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 16103\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16103,"size_decoded":16346,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit colormap, non-interlaced","md5":"0dd192b3d2b7ba67e10cbefc1671490a","sha1":"460d3deb22fe8f9ac8e2aea7fef490975300116e","sha256":"7bdd05fd6f7ad3b2cf46b6e0c9b2a996065e9a478e52274c7e99e11941867ae6","sha512":"75db380594d79f28733cd0474f5efd8b205d9d1efd64c10ec663f57cfef6717b712dadac0770064c37cc16e0e016e803fa080789f5ea62cb9b237565acf6b150","ssdeep":"384:qhowNW50BLNAqOKO3DIZTZajYt9ZFJPWX0Lc+:qmKiqOrkZ8chviU","tlshash":"6e72e12ccee3c605be94894e015521ac8072c888cf42bf3e443a656e7b8f0567fa719b","first_seen":"2025-02-11T15:42:52.593348Z","last_seen":"2026-07-17T19:20:40.734429Z","times_seen":42,"resource_available":false,"data":null}},"time_used":3182,"timings":{"blocked":2907,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"mail.itsmebay.rumahsakit.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"mail.itsmebay.rumahsakit.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.itsmebay.rumahsakit.de/","date":"2026-07-17T19:19:59.730Z","timestamp":1784315999730,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mail.itsmebay.rumahsakit.de/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29707\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 12 Jul 2026 10:10:21 GMT\r\nexpires: Mon, 12 Jul 2027 10:10:21 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 464978\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":84320,"size_decoded":30671,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32180)","md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-17T20:56:53.502501Z","times_seen":15965,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}