{"report_id":"e11e336e-4f25-4571-8360-915b2c32d6f6","version":0,"status":"done","tags":[],"date":"2026-09-21T14:37:42Z","url":{"schema":"http","addr":"mail.bodoho.com/","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":0,"asn":210644,"as":"Aeza Group LLC","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"mail.bodoho.com/","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"title":"Webmail :: Welcome to Webmail","dom":{"size":5882,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1329)","md5":"20c1ce9ee171deb09df7a129c325239b","sha1":"c6421275a436e3e6abda90ec5f2a98ded9c24636","sha256":"5b8912436e25033efcab53e04ac38134c4c4094084da14fccd70cbd36e35f31b","sha512":"8a1d76486c90bf0ed0d4cc432a089f2c3e2bb7c9cf4b7bdd80aa8fa4362a361d5f3756265c68640bff2af5e03388b335e322badfc126cb39cb9b8a1fee17b38b","ssdeep":"96:JUkP9J8tENUJogQwNDGFAbOMJnwvNditUKr:SkP9J86KJogQwNDGFASMJnhtUKr","tlshash":"ebc1f9423c04ce3b14b108ec70daf68a98fdc279d6205c58b8fc826d1f95f6946fa6a1","dom_hash":"domhashbb3f93df6a567b9213ed3f2f5e0f08a6","first_seen":"2026-09-21T14:37:49.541255Z","last_seen":"2026-09-21T14:37:49.541255Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mail.bodoho.com/","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":0,"asn":210644,"as":"Aeza Group LLC","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-26T14:37:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mail.bodoho.com","ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-05","domain_rank":0,"first_seen":"2026-09-21T13:29:27.466387Z","last_seen":"2026-09-21T13:29:27.466387Z","alert_count":42,"request_count":14,"received_data":1152221,"sent_data":7801,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/jquery.min.js?s=1783249202","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"51c27f2718dabb8c5183460bdabab54e","sha1":"18e6690eb4a02d9a26a53261db0a28b821c68e4e","sha256":"d559634f87938dcda6bdd16248590960a2b947a737b5ac50beb457b2cdd486d6","sha512":"266d8e3f04c5dce1e289b6765619112235366f913492b73e6055499dc6d155939a85553d2a5e1b2ab771bb29db67f40538bbae643a8278ec0c5fb7921670e206","ssdeep":"1536:LZ0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:KHNwcv9VBQpLl88SMBQ47GKr","tlshash":"2393f8df73ca702247ab30b9006f550bf276199d684d4440f169e8e9bc78a4a827bf7d","size":88983,"data":"","first_seen":"2025-12-07T09:48:53.159308Z","last_seen":"2026-09-21T14:37:49.544012Z","times_seen":81,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/common.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa6311e8cb49c2e4e53329994fa73dd8","sha1":"43f57acb59493ac976815d37855bc4fd642baeb6","sha256":"a1d38d6bad7932a16432bc1f104c6b5aad6dc7a68b63fb5047c900f7b0ab042a","sha512":"f4c1a32b8c451024ec81e51c2985b8cbb47cd01b4687809cdf86fe7b2ab972acf07b00c3e4a4a87ab1f092df7158393646087c97db98ad799a123b75d6af5e60","ssdeep":"384:KBenw2doswRoA/fIeVVunYJ16t51qn9Z/:cenwAosrA/fIeaYJEt8","tlshash":"24522acf32956472026d6aa7267b024fb13285b86c3610bcf664cce5bc38c59552ffb4","size":13354,"data":"","first_seen":"2026-05-27T06:08:56.885977Z","last_seen":"2026-09-21T14:37:49.544691Z","times_seen":74,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/app.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"8987546f3fb75f3ee1f44f6d6e5c0319","sha1":"2ac1af2c139467784167bda3b9b7943193f1b7ca","sha256":"d7069c774d8d3a87fcf393d4d9a0362de1ae1bae7a76fe22a2f09ef56aa8d114","sha512":"72b77174fc609d2ade3a3a907bd7d0acf148e3d65754b3e68117832f3a161220fd876acbcc0fd3e070bb7bf57a5c0fe1e78b80235c77bdc948e76721acb1f41d","ssdeep":"3072:VM8dZO426S0uS8wHXnTxdhXqltUS7SXm7b:VM8dZOLuuSHHXnTxd1q3USOXS","tlshash":"c8f3d69a32a4ed2105e69763746f31016233b609e404980db96cd9eb4e74f4a3367f7e","size":172707,"data":"","first_seen":"2026-05-27T06:08:56.865686Z","last_seen":"2026-09-21T14:37:49.547007Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/plugins/jqueryui/js/jquery-ui.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"01b00dc27e3831f4f8093fc111890e6e","sha1":"b9b8f114c58d3ea37f75216550a0f6c5022885f9","sha256":"45b30930d5752603cdff2d24aa942b5bbae3168f62e74e092cd9405ff10127f7","sha512":"eedee6ecfc17cf804088b0d5f5d7ae995ce0cccacd0d91bc7eebb0f53e26c9bd0d3010a971acd855d2b4f803d8951d87a11c978463a2760e1e19017b931d838e","ssdeep":"3072:eDPNddBFak8JUaVDpYujVHUc92smVppuzUPFI9fB8NpjJSyACAo0MY:uNdIVWjNS9cdzAo0MY","tlshash":"6f44084d72403a3295dfa1a5103b2a0ba237955da601809cb43ccedf9e7ce4571bbfb9","size":262502,"data":"","first_seen":"2023-09-22T15:52:32Z","last_seen":"2026-09-21T14:37:49.55401Z","times_seen":1890,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/deps/bootstrap.bundle.min.js?s=1783249204","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"3fb9784331ba8d606ca6e0877b9466a3","sha1":"2c8dde7ea3cee76f061c06bb64f9f00497f893f3","sha256":"19b51730c10082760e6d9b82c1342e60855f98d2666c64e4eb758d26b1a0c840","sha512":"a34c44d07455be21ca911be580524a6dc5c4d4cb91f46030c26c4d258ae9a46334e65a27a57aeb987c1801238919e6ffac280bbb5542899a8956c5577e7f0c40","ssdeep":"768:du/iPy7+zZHVPVBNpwV7BTUB6/YLF/fB+4ed4MMAja+t+QnXLb1+uaR+orWieOJ9:deiayUYLZ83dPD3GAP6f2jX+i/QB","tlshash":"8a83834972a0b472069f61a6807b4a0bf2372c5da107b01cbad9d4ed1f7cd893167f7a","size":84104,"data":"","first_seen":"2023-03-07T12:08:25Z","last_seen":"2026-09-21T14:37:49.549623Z","times_seen":3018,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/ui.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"d0d0f95df946eb709615764669d089f0","sha1":"fd2ee0e5b3fc2d619ee7f3b464da7893aa4a159a","sha256":"c839059bd25af2271c74075825936bf37b5821861d14e512e7517ea07d15fc0d","sha512":"f29fafd03cbbac02290c163f5b9bb35fc49a0a0976a5bad68e12756b8e415a7d782711d04fd3ca37a5874c238db6b30c249df1b629ff153a5f3b64051dba7fe4","ssdeep":"768:iOyiEHYQp4MPtuwhycLArO+SlgBd13Rb6tpzS1gVKU6Hyfw1hkRZd1WrRPyQvdp7:Di2kwcLVwd1NyV612Z7Wr0M","tlshash":"8c53c6dc726135b612bf226760afe10662334529cd119840b26d94ea1efce8532b7f7f","size":63100,"data":"","first_seen":"2026-05-27T06:08:56.876783Z","last_seen":"2026-09-21T14:37:49.554702Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/fonts/fa-solid-900.woff2","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.829Z","timestamp":1790001423829,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/fonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://mail.bodoho.com/static.php/skins/elastic/styles/styles.min.css?s=1783249197\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 75440\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75440,"size_decoded":75860,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 75440, version 329.-1049","md5":"b5cf8ae26748570d8fb95a47f46b69e1","sha1":"07bed153d47f9129a944ee54dd72952deed074c8","sha256":"cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0","sha512":"f08b9289695cf530094f076b2df4d2b0e1a1daedd00190d123b4179b2c1a1b5e8b2bb988d86fc6dc9eee117d88a58dd5b6dfe7689586c17068f5d2da01904d76","ssdeep":"1536:1Zq/f5ldhNurIqp+jqNT5Fm653lqWppat1Wa4W8TeodjxNrqM:1kvdS7ppFm6JhpgkrW6bGM","tlshash":"6f73028e1719f192f5d6cd177edc20be38f1a7121008f839e2eda6dd5085ab639a3825","first_seen":"2023-04-05T08:48:24Z","last_seen":"2026-09-21T16:49:33.758986Z","times_seen":23311,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/jquery.min.js?s=1783249202","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.469Z","timestamp":1790001423469,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/program/js/jquery.min.js?s=1783249202 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 88983\r\nlast-modified: Sun, 05 Jul 2026 11:00:02 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88983,"size_decoded":89422,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (63997)","md5":"51c27f2718dabb8c5183460bdabab54e","sha1":"18e6690eb4a02d9a26a53261db0a28b821c68e4e","sha256":"d559634f87938dcda6bdd16248590960a2b947a737b5ac50beb457b2cdd486d6","sha512":"266d8e3f04c5dce1e289b6765619112235366f913492b73e6055499dc6d155939a85553d2a5e1b2ab771bb29db67f40538bbae643a8278ec0c5fb7921670e206","ssdeep":"1536:LZ0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:KHNwcv9VBQpLl88SMBQ47GKr","tlshash":"2393f8df73ca702247ab30b9006f550bf276199d684d4440f169e8e9bc78a4a827bf7d","first_seen":"2025-12-07T09:48:53.159308Z","last_seen":"2026-09-21T14:37:49.544012Z","times_seen":81,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/common.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.470Z","timestamp":1790001423470,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/program/js/common.min.js?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 13354\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13354,"size_decoded":13793,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (12218)","md5":"fa6311e8cb49c2e4e53329994fa73dd8","sha1":"43f57acb59493ac976815d37855bc4fd642baeb6","sha256":"a1d38d6bad7932a16432bc1f104c6b5aad6dc7a68b63fb5047c900f7b0ab042a","sha512":"f4c1a32b8c451024ec81e51c2985b8cbb47cd01b4687809cdf86fe7b2ab972acf07b00c3e4a4a87ab1f092df7158393646087c97db98ad799a123b75d6af5e60","ssdeep":"384:KBenw2doswRoA/fIeVVunYJ16t51qn9Z/:cenwAosrA/fIeaYJEt8","tlshash":"24522acf32956472026d6aa7267b024fb13285b86c3610bcf664cce5bc38c59552ffb4","first_seen":"2026-05-27T06:08:56.885977Z","last_seen":"2026-09-21T14:37:49.544691Z","times_seen":74,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/images/favicon.ico?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.861Z","timestamp":1790001423861,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/images/favicon.ico?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 16958\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16958,"size_decoded":17380,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"924a68d347c80d0e502157e83812bb23","sha1":"1622a7caa5a0cfa28a96cf10043d6e7b63b491e3","sha256":"7b30e499996ec4631848d3509d803d9311f5d71999212f2f4c1ca7af8f24eb69","sha512":"f366ac7f1b54471f7222d5425bbb08da8ea971f175fe96d1b551020cf85184f2e76bb49d270c711cf6f7937d809d6446cf5e2c0e4f4c2baadb5925eb97ef146b","ssdeep":"48:hJzQ0zzz0TzzzzicUzzzzzzqzzzzzzzzhzzzzzzzzzz3zzzzzzzzzzzVzzzzzzzg:hxjDtJo/S5Pb","tlshash":"2d7268443bbfb848f1ed56f2af41b71011212c7a42e41786aa91ab2957223d3bf3c84c","first_seen":"2023-04-21T21:19:20Z","last_seen":"2026-09-21T14:37:49.54554Z","times_seen":2129,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.468Z","timestamp":1790001423468,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/css;charset=UTF-8\r\ncontent-length: 29309\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29309,"size_decoded":29741,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (26371)","md5":"7e848d774e13122792027c11b994c19c","sha1":"276df81de919d3614fbb970a6dbdbb7a0570e40c","sha256":"aad541bcbd68b5ea0300c91b804637a2706e983a46d93546b109e6f322869107","sha512":"9e277ee3e4af841c5e6c82df943ff2ed33b4cbc47d3573b8990b3ccc24a9a5a5878e3b42896836bbb356d4107b728d9c0da3d5e73cb42d66e1891d9e60f097a5","ssdeep":"384:OCwiEt7/rpc5CN14/1ejUEzy9pDFkM7nfPBV5T:tlEtTN14EUEzQpDhBVB","tlshash":"65d23230a5c2243dfe33d23061e15ef4523ac246dda61fbda09af65953ea8e4c47b871","first_seen":"2023-11-08T04:46:40Z","last_seen":"2026-09-21T14:37:49.546245Z","times_seen":1762,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/program/js/app.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.472Z","timestamp":1790001423472,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/program/js/app.min.js?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 172707\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":172707,"size_decoded":173147,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (64152)","md5":"8987546f3fb75f3ee1f44f6d6e5c0319","sha1":"2ac1af2c139467784167bda3b9b7943193f1b7ca","sha256":"d7069c774d8d3a87fcf393d4d9a0362de1ae1bae7a76fe22a2f09ef56aa8d114","sha512":"72b77174fc609d2ade3a3a907bd7d0acf148e3d65754b3e68117832f3a161220fd876acbcc0fd3e070bb7bf57a5c0fe1e78b80235c77bdc948e76721acb1f41d","ssdeep":"3072:VM8dZO426S0uS8wHXnTxdhXqltUS7SXm7b:VM8dZOLuuSHHXnTxd1q3USOXS","tlshash":"c8f3d69a32a4ed2105e69763746f31016233b609e404980db96cd9eb4e74f4a3367f7e","first_seen":"2026-05-27T06:08:56.865686Z","last_seen":"2026-09-21T14:37:49.547007Z","times_seen":46,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":80,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/images/logo.svg?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.483Z","timestamp":1790001423483,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/images/logo.svg?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 888\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":888,"size_decoded":1309,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ddeffd34eae92b1b9b9c636636e4b9c8","sha1":"19cb881a5d08d31db933da6440595767d0a02d94","sha256":"2b2d9c7a82f92976268b03e13c61f64ead91a3c63b97c59cef2acbf501f67618","sha512":"a3807dbcbdc74972c7b028261e625edb1eec8f6b31969d6718a46d0402a1b261820f8060f760c9249f88b51076174b53628d152c4c75eeb2c5a3db6c16348f5b","ssdeep":"","tlshash":"f011cc5e56d4a69c440902ffefbe62d231b3a4efc20040a980f1ef30a9149342882af8","first_seen":"2023-05-02T14:07:32Z","last_seen":"2026-09-21T14:37:49.547652Z","times_seen":3042,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":78,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/styles/styles.min.css?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.467Z","timestamp":1790001423467,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/styles/styles.min.css?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/css;charset=UTF-8\r\ncontent-length: 122715\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":122715,"size_decoded":123148,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d2f97088ddcaacb6a9662f734e77444e","sha1":"b4368cb294c801044b5391606b081573c71deb21","sha256":"7bcb74f4d5e1718955a2ef1fb1b1c726152d4a8725b71a87f77bbd3bbc3ba0c4","sha512":"2d667af5fd565351e756a02d40a3eef57c75dd2eb84b7a69772bdf47e0948b0634fa5285ebcc9daa505d006001ca8afeb04f29c40c0e1125baa10704a33220fb","ssdeep":"1536:2HT+N/E06N+L4tS9kH/sQzljA8SgWFPR79kmCZ:2H6N/E06N+L4yY/sQzo9kmCZ","tlshash":"3bc3d5b6e16839ad3733c2177ac4bb98a25ed1a0c4517e7af52b328d85ca21c3173f15","first_seen":"2026-05-27T06:08:56.883667Z","last_seen":"2026-09-21T14:37:49.548859Z","times_seen":70,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/deps/bootstrap.bundle.min.js?s=1783249204","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.474Z","timestamp":1790001423474,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/deps/bootstrap.bundle.min.js?s=1783249204 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 84104\r\nlast-modified: Sun, 05 Jul 2026 11:00:04 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":84104,"size_decoded":84543,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"3fb9784331ba8d606ca6e0877b9466a3","sha1":"2c8dde7ea3cee76f061c06bb64f9f00497f893f3","sha256":"19b51730c10082760e6d9b82c1342e60855f98d2666c64e4eb758d26b1a0c840","sha512":"a34c44d07455be21ca911be580524a6dc5c4d4cb91f46030c26c4d258ae9a46334e65a27a57aeb987c1801238919e6ffac280bbb5542899a8956c5577e7f0c40","ssdeep":"768:du/iPy7+zZHVPVBNpwV7BTUB6/YLF/fB+4ed4MMAja+t+QnXLb1+uaR+orWieOJ9:deiayUYLZ83dPD3GAP6f2jX+i/QB","tlshash":"8a83834972a0b472069f61a6807b4a0bf2372c5da107b01cbad9d4ed1f7cd893167f7a","first_seen":"2023-03-07T12:08:25Z","last_seen":"2026-09-21T14:37:49.549623Z","times_seen":3018,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/fonts/roboto-v29-regular.woff2","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.827Z","timestamp":1790001423827,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/fonts/roboto-v29-regular.woff2 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://mail.bodoho.com/static.php/skins/elastic/styles/styles.min.css?s=1783249197\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 50240\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50240,"size_decoded":50660,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 50240, version 1.0","md5":"184a2a669cf798f8d80bcfba041c3ecf","sha1":"b8dbbf83b27b5e4f5588f997685b2ccfecf97ff6","sha256":"659a8dee04b272c247129ff6513d23c16f4f9c183b5d64e7347815af8861a2a4","sha512":"c882dfc93fe0b07584a21a24b9e89ef8b3b6ce3e07d3f1b822f750a18aff353997cddf11c711aefe90861787068d7e281d23c8cfd5299b883122ad74f3dfa8ec","ssdeep":"768:6bJwA9k86TOHxuA86y3RmDLiszi9Y8Z6TDeNKOVVJL/OaQ+yZ0POddMC198qBhDH:ye/86qubk3zdv9IVJ5Q+U0QBd22","tlshash":"f93301f201bbbff4e44c17b7e202f4260f0d266d8a8e299e504e8afd157c5a1057b92c","first_seen":"2023-04-19T10:40:33Z","last_seen":"2026-09-21T14:37:49.55037Z","times_seen":3175,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-21T14:37:02.867Z","timestamp":1790001422867,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2; path=/; secure; HttpOnly\r\nexpires: Mon, 21 Sep 2026 14:37:02 GMT\r\nlast-modified: Mon, 21 Sep 2026 14:37:02 GMT\r\ncache-control: private, no-cache, no-store, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\ncontent-language: en\r\nx-content-type-options: nosniff\r\nx-frame-options: sameorigin, SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"roundcube_sessid","value":"j44h9giqgngveh87q26j9ls6q2","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"","partitioned":false,"raw":"roundcube_sessid=j44h9giqgngveh87q26j9ls6q2; path=/; secure; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":5360,"size_decoded":2981,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (841)","md5":"c04d6a61198a9047459559ebcee51cc1","sha1":"d4d27efe967afea6e5eca28c0769c206c8e9ade8","sha256":"7d927a4a49ecdb8803a6fa18388419e7d43236b7067aa35ec99ff1773f763998","sha512":"734b82ae8abf7e2e771662fea56b0ffffadf7fcac6344fe125cec234afbf6aaaec985b0d2d592610684c15256f0c48c1ca39187a01ca6e58e6608798935b3e83","ssdeep":"96:HUkP9J8tENUJogQwNDGFAbOMJnwvXa/otUKZz:0kP9J86KJogQwNDGFASMJn29tUKZz","tlshash":"eeb1c6423c44ce3b19b104ec74caf28d95fdd279d2206c98f8fd826d1f95f6846ea6a1","first_seen":"2026-09-21T14:37:49.551067Z","last_seen":"2026-09-21T14:37:49.551067Z","times_seen":1,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":5,"connect":25,"send":0,"wait":33,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/deps/bootstrap.min.css?s=1783249204","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.461Z","timestamp":1790001423461,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/deps/bootstrap.min.css?s=1783249204 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/css;charset=UTF-8\r\ncontent-length: 160347\r\nlast-modified: Sun, 05 Jul 2026 11:00:04 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":160347,"size_decoded":160780,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65326)","md5":"c19c75612682a6fa2491c27dee895acc","sha1":"7344d84f61735eb9653b729e71d81b3431ad803c","sha256":"3cb5b7ae5053d743996378c35733560214d3d896ade5c0de0d8b13a97f43039e","sha512":"5874fc8a3fc032eda3dec8e11b0468b33788349149facf00d67daa9e9cf4699304758fde421e29ea597fb01da228d8465f85a70462ca920325a0fab2d58a6943","ssdeep":"1536:kw7CIJ0T+r+ryEIA1pDEBi8yNcuSEIA1/uypq3SYiLENM6HN26s:H7VKGGq3SYiLENM6HN26s","tlshash":"97f353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf8273b6447892c70a73e4c","first_seen":"2023-04-06T22:58:11Z","last_seen":"2026-09-21T14:37:49.552987Z","times_seen":3376,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/plugins/jqueryui/js/jquery-ui.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.473Z","timestamp":1790001423473,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/plugins/jqueryui/js/jquery-ui.min.js?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 262502\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":262502,"size_decoded":262942,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64399)","md5":"01b00dc27e3831f4f8093fc111890e6e","sha1":"b9b8f114c58d3ea37f75216550a0f6c5022885f9","sha256":"45b30930d5752603cdff2d24aa942b5bbae3168f62e74e092cd9405ff10127f7","sha512":"eedee6ecfc17cf804088b0d5f5d7ae995ce0cccacd0d91bc7eebb0f53e26c9bd0d3010a971acd855d2b4f803d8951d87a11c978463a2760e1e19017b931d838e","ssdeep":"3072:eDPNddBFak8JUaVDpYujVHUc92smVppuzUPFI9fB8NpjJSyACAo0MY:uNdIVWjNS9cdzAo0MY","tlshash":"6f44084d72403a3295dfa1a5103b2a0ba237955da601809cb43ccedf9e7ce4571bbfb9","first_seen":"2023-09-22T15:52:32Z","last_seen":"2026-09-21T14:37:49.55401Z","times_seen":1890,"resource_available":true,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":90,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mail.bodoho.com/static.php/skins/elastic/ui.min.js?s=1783249197","fqdn":"mail.bodoho.com","domain":"bodoho.com","tld":"com"},"ip":{"addr":"89.208.106.132","port":443,"asn":210644,"as":"Aeza International Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mail.bodoho.com/","date":"2026-09-21T14:37:03.475Z","timestamp":1790001423475,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.bcxomail.pw","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:51:24 GMT","end":"Wed, 21 Oct 2026 15:51:23 GMT"},"fingerprint":{"sha1":"76:08:F7:BB:3E:A5:99:3C:AA:58:01:15:4E:29:37:AA:78:B7:DC:AE","sha256":"91:F8:00:51:0F:13:B9:96:D6:CF:31:05:BC:6A:34:5F:46:7F:04:D5:B7:98:55:F2:F3:78:EC:6B:15:CE:EB:E0"}}},"request":{"raw":"GET /static.php/skins/elastic/ui.min.js?s=1783249197 HTTP/1.1\r\nHost: mail.bodoho.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://mail.bodoho.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: roundcube_sessid=j44h9giqgngveh87q26j9ls6q2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 21 Sep 2026 14:37:03 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 63100\r\nlast-modified: Sun, 05 Jul 2026 10:59:57 GMT\r\naccept-ranges: bytes\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Oct 2026 14:37:03 GMT\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: same-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63100,"size_decoded":63539,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (62612)","md5":"d0d0f95df946eb709615764669d089f0","sha1":"fd2ee0e5b3fc2d619ee7f3b464da7893aa4a159a","sha256":"c839059bd25af2271c74075825936bf37b5821861d14e512e7517ea07d15fc0d","sha512":"f29fafd03cbbac02290c163f5b9bb35fc49a0a0976a5bad68e12756b8e415a7d782711d04fd3ca37a5874c238db6b30c249df1b629ff153a5f3b64051dba7fe4","ssdeep":"768:iOyiEHYQp4MPtuwhycLArO+SlgBd13Rb6tpzS1gVKU6Hyfw1hkRZd1WrRPyQvdp7:Di2kwcLVwd1NyV612Z7Wr0M","tlshash":"8c53c6dc726135b612bf226760afe10662334529cd119840b26d94ea1efce8532b7f7f","first_seen":"2026-05-27T06:08:56.876783Z","last_seen":"2026-09-21T14:37:49.554702Z","times_seen":43,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-21","alert":"Phishing Block","trigger":"mail.bodoho.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-21","alert":"Sinkholed","trigger":"mail.bodoho.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}