{"report_id":"e33ea5a7-71bd-477e-8abd-b5631303d682","version":0,"status":"done","tags":["zimbra","phishing"],"date":"2026-07-30T12:06:58Z","url":{"schema":"http","addr":"webmailadminhelpdesk.serveousercontent.com","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"ip":{"addr":"5.255.123.12","port":0,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"webmailadminhelpdesk.serveousercontent.com/","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"title":"Zimbra Web Client Sign In","dom":{"size":23211,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (643)","md5":"ab143c739499b152160c3a5feddfc3f4","sha1":"1c4e5ceaf2461e1e528226115bc0bcf7e8a68a1e","sha256":"26b486fbf03bcee4b85b30d3589f4cf3f2cb6eb57527f7e47e536df0399c8d7a","sha512":"086a56aedd8156981197fb473f9712cfb83a6f2bf4aa213e1c3a8efc02d37725c9a81ed1f507c9c617e09d17865f50ef28ccbff3984ef2a26d4367c5b417f2b8","ssdeep":"384:HGjhRgFO3nhkxUT4O6YXhl2Ei0m5HDpupShi4i2iZi5iFieigiMiniHiNJci8i3:mjD3nhkxUT4O66tc/oVHgA0v9BiCNJRB","tlshash":"dda2d76625e518610aa770fc59df111934b0dc271009ce087dfc92a83fb6e6a57a3bfe","dom_hash":"domhashb65de971afbbd68ea8a62d11d24f98cd","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"webmailadminhelpdesk.serveousercontent.com","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"ip":{"addr":"5.255.123.12","port":0,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-03T12:06:58Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-30","alert":"Sinkholed","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-30","alert":"Sinkholed","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-30","alert":"Phishing Block","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Zimbra Web Client","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Zimbra phishing","tags":["zimbra","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Zimbra Web Client","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Zimbra phishing","tags":["zimbra","phishing"],"meta":null}]},"summary":[{"fqdn":"webmailadminhelpdesk.serveousercontent.com","ip":{"addr":"5.255.123.12","port":443,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-11-02","domain_rank":0,"first_seen":"2026-07-14T07:50:25.801633Z","last_seen":"2026-07-30T03:54:56.60009Z","alert_count":4,"request_count":1,"received_data":23703,"sent_data":511,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server:2.4.68","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Debian","description":"Debian is a Linux software which is a free open-source software.","website":"https://debian.org","common_platform_enumeration":"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*","icon":"Debian.png","categories":["Operating systems"]}]},{"fqdn":"savba.savba.sk","ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"domain_registered":"2003-09-16","domain_rank":2526556,"first_seen":"2026-07-30T03:54:55.995341Z","last_seen":"2026-07-30T03:54:55.995341Z","alert_count":0,"request_count":5,"received_data":233084,"sent_data":2990,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Zimbra Web Client","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Zimbra phishing","tags":["zimbra","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"webmailadminhelpdesk.serveousercontent.com/","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"ip":{"addr":"5.255.123.12","port":443,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"eventHandler","is_inline":false,"md5":"8330d67045d053b17fa969ef2bdb5e54","sha1":"041174325b27a7b4d2d1b1a0e353fa82d1cb6431","sha256":"ceecf99c8bd1f6e5f89a26d3b40e009d48860d674231297254ff75d817b9a883","sha512":"74d90352264865f9903b3845c8d7c001ae7efeee02016907f39d1726f12a1f33903ebeeed1d3643de50ff4919cd819a4e419a918b584a3950f2a4ff9ca7bb1f3","ssdeep":"","tlshash":"e7500000030030c00300000c3000000c000000c30003c000000000003c300000030030","size":9,"data":"","first_seen":"2023-04-11T04:37:13Z","last_seen":"2026-08-01T09:53:49.184295Z","times_seen":4002,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webmailadminhelpdesk.serveousercontent.com/","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"ip":{"addr":"5.255.123.12","port":443,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"3b3886f631c65a78d12b58b9060d7c1e","sha1":"6e894290c9d9cd20c8187c7aa09540426a57d5a4","sha256":"b09848e92f922af78592bab49b1396651f3410cbb9009c58b657948f8616adc1","sha512":"6a828c5860429de0bfb73707723cb3efc105111cfd17fac3c9b9556b9cfbd1c27a5366e8197dcd8c6a47be8b4e19e2e2b5f8569f8304242639c983b71c65ec43","ssdeep":"384:BxUT4O6YXhl2Ei0m5HDpupShi4i2iZi5iFieigiMiniHiNJci8i4:BxUT4O66tc/oVHgA0v9BiCNJRx4","tlshash":"6f7287aa35ea18510aa770bc89df111834b098171009df047dfc91a87f75e7a16a7bfe","size":16513,"data":"","first_seen":"2026-07-30T03:54:57.43747Z","last_seen":"2026-07-30T12:07:15.948418Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"webmailadminhelpdesk.serveousercontent.com/","fqdn":"webmailadminhelpdesk.serveousercontent.com","domain":"serveousercontent.com","tld":"com"},"ip":{"addr":"5.255.123.12","port":443,"asn":60404,"as":"The Infrastructure Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-30T12:06:30.983Z","timestamp":1785413190983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"serveousercontent.com","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Mon, 04 May 2026 00:00:00 GMT","end":"Sun, 02 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"BC:90:2E:CF:00:81:0C:FD:8B:69:40:47:C6:34:A3:83:21:C9:0C:C3","sha256":"1B:D7:66:2A:1E:46:6B:21:60:17:70:B9:0A:BF:15:FB:1A:31:02:CD:3B:60:BE:A9:C8:1C:54:A9:74:98:E4:48"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: webmailadminhelpdesk.serveousercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Thu, 30 Jul 2026 12:06:31 GMT\r\netag: \"5b6c-65749707da474-gzip\"\r\nlast-modified: Thu, 23 Jul 2026 16:06:31 GMT\r\nserver: Apache/2.4.68 (Debian)\r\nvary: Accept-Encoding\r\ncontent-length: 6257\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server:2.4.68","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Debian","description":"Debian is a Linux software which is a free open-source software.","website":"https://debian.org","common_platform_enumeration":"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*","icon":"Debian.png","categories":["Operating systems"]}],"data":{"size":23404,"size_decoded":6556,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (631)","md5":"08435e27a8b020090568dd63a3940f18","sha1":"afe500ad54425c5ca1d3b3e951f491deb7a6042e","sha256":"5dd31cc890fd2bf528a977c5a7a2a95ad648562db25effbdeb99aa434e558c8a","sha512":"f2e9202d507f501c128367c9856da9d51e244936f4a0bc6cfc41372bd4749b32c0a9c66562d7ec6d60828edd203b66d741bdf05618ff51ca66a7a8f2d4471c83","ssdeep":"384:KbTkwmMO7LhkxUT4O6YXhl2Ei0m5HDpupShi4i2iZi5iFieigiMiniHiNJci8i7:KTm7LhkxUT4O66tc/oVHgA0v9BiCNJRl","tlshash":"b1b2d76625e518610aa370bc59cf111934b4dc271009ce087dfc92ac3fb6e6a57a3bfe","first_seen":"2026-07-30T03:54:57.434594Z","last_seen":"2026-07-30T12:07:15.94224Z","times_seen":4,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":37,"connect":20,"send":0,"wait":159,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-30","alert":"Sinkholed","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-30","alert":"Sinkholed","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-30","alert":"Phishing Block","trigger":"webmailadminhelpdesk.serveousercontent.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Zimbra Web Client","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Zimbra phishing","tags":["zimbra","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"savba.savba.sk/css/common,login,zhtml,skin.css?skin=harmony\u0026v=260427132613","fqdn":"savba.savba.sk","domain":"savba.sk","tld":"sk"},"ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://webmailadminhelpdesk.serveousercontent.com/","date":"2026-07-30T12:06:31.582Z","timestamp":1785413191582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savba.savba.sk","organization":""},"issuer":{"commonName":"GEANT TLS RSA 1","organization":"Hellenic Academic and Research Institutions CA"},"validity":{"start":"Tue, 11 Nov 2025 17:58:48 GMT","end":"Wed, 11 Nov 2026 17:58:48 GMT"},"fingerprint":{"sha1":"A6:8D:59:48:EF:95:00:39:C6:3E:8A:38:6F:3C:BD:7E:50:D0:D6:49","sha256":"89:C5:1A:8F:46:DA:38:1F:35:8B:8A:68:2E:F9:EC:F2:18:62:E3:9E:72:69:08:74:DE:C9:BA:05:C3:BA:D0:AC"}}},"request":{"raw":"GET /css/common,login,zhtml,skin.css?skin=harmony\u0026v=260427132613 HTTP/1.1\r\nHost: savba.savba.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webmailadminhelpdesk.serveousercontent.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 30 Jul 2026 12:06:31 GMT\r\ncontent-type: text/css\r\nx-frame-options: SAMEORIGIN\r\nexpires: Sat, 29 Aug 2026 13:06:31 GMT\r\ncache-control: public, max-age=2595600\r\nvary: User-Agent, Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65814,"size_decoded":13631,"mime_type":"text/css","magic":"ASCII text, with very long lines (751)","md5":"c91fcee291ba1d77121a2b14eb11666c","sha1":"624368c3cea3f425375aaff460f31521993682e0","sha256":"d3a5ff32f6c7c494b52479d02326c2abc48f7628c13039bfaa7503c36478151c","sha512":"226fadac21bdf91f18106e7f742a41330516350e4ed8006da90a7b96c8e1f62873a8057fd639cbf407687780cdc3f33aa0a739c8ece1b99d1a629c60fce5a290","ssdeep":"384:twGDVYTNgzXv1ZQeZmlucf+TRmyiFEu+jF9a/C/WYlcdBC7h/GZDQIgLq/EtwXsC:tFfv1ZuuLaEu+0C/mDU/twcx9x4EG","tlshash":"4153c831f342201eb02bc46ee443fad8692a9157c9675f79f937b479eac60dd1a23306","first_seen":"2026-07-30T03:54:57.43571Z","last_seen":"2026-07-31T07:06:19.928671Z","times_seen":5,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":140,"connect":48,"send":0,"wait":53,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"savba.savba.sk/img/new-back-ground-image.png","fqdn":"savba.savba.sk","domain":"savba.sk","tld":"sk"},"ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webmailadminhelpdesk.serveousercontent.com/","date":"2026-07-30T12:06:31.936Z","timestamp":1785413191936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savba.savba.sk","organization":""},"issuer":{"commonName":"GEANT TLS RSA 1","organization":"Hellenic Academic and Research Institutions CA"},"validity":{"start":"Tue, 11 Nov 2025 17:58:48 GMT","end":"Wed, 11 Nov 2026 17:58:48 GMT"},"fingerprint":{"sha1":"A6:8D:59:48:EF:95:00:39:C6:3E:8A:38:6F:3C:BD:7E:50:D0:D6:49","sha256":"89:C5:1A:8F:46:DA:38:1F:35:8B:8A:68:2E:F9:EC:F2:18:62:E3:9E:72:69:08:74:DE:C9:BA:05:C3:BA:D0:AC"}}},"request":{"raw":"GET /img/new-back-ground-image.png HTTP/1.1\r\nHost: savba.savba.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://savba.savba.sk/css/common,login,zhtml,skin.css?skin=harmony\u0026v=260427132613\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 30 Jul 2026 12:06:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 141674\r\nx-frame-options: SAMEORIGIN\r\nexpires: Sat, 29 Aug 2026 13:06:31 GMT\r\ncache-control: public, max-age=2595600\r\nlast-modified: Tue, 07 Jul 2026 09:32:40 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":141674,"size_decoded":141987,"mime_type":"image/png","magic":"PNG image data, 1440 x 1024, 8-bit colormap, non-interlaced","md5":"5a09af857512a874f5e2a6e01b80742b","sha1":"8c87bcfd42ee8fab57f08c3664abd1424e608b6a","sha256":"18b729cd6f3dd2b5657c1680e1388b825dc2c2d1e732e03478006714ac7ebc2d","sha512":"0f5a6c382957c3ee0078db97ae58f109e3ecc04d31609cd6047b4904b220bd45ff055e4a6abb058a6e0c760c4a4beba7f114a6d86b5179fccdcd5d334e835a1f","ssdeep":"3072:Xp4eV0s/ltkbEd0U+sl5mk0Xy0X+9uZPkB584B5DMs:Xd/ltka0LXmQw58EDL","tlshash":"00d3122e58f35215dce8e8bc3cbeb8fb295e23b44474dbfa5258c2050e99a36c4d8d11","first_seen":"2023-05-12T19:43:56Z","last_seen":"2026-08-01T03:04:56.434338Z","times_seen":953,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"savba.savba.sk/skins/_base/logos/LoginBanner.png?v=260707094130","fqdn":"savba.savba.sk","domain":"savba.sk","tld":"sk"},"ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webmailadminhelpdesk.serveousercontent.com/","date":"2026-07-30T12:06:31.938Z","timestamp":1785413191938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savba.savba.sk","organization":""},"issuer":{"commonName":"GEANT TLS RSA 1","organization":"Hellenic Academic and Research Institutions CA"},"validity":{"start":"Tue, 11 Nov 2025 17:58:48 GMT","end":"Wed, 11 Nov 2026 17:58:48 GMT"},"fingerprint":{"sha1":"A6:8D:59:48:EF:95:00:39:C6:3E:8A:38:6F:3C:BD:7E:50:D0:D6:49","sha256":"89:C5:1A:8F:46:DA:38:1F:35:8B:8A:68:2E:F9:EC:F2:18:62:E3:9E:72:69:08:74:DE:C9:BA:05:C3:BA:D0:AC"}}},"request":{"raw":"GET /skins/_base/logos/LoginBanner.png?v=260707094130 HTTP/1.1\r\nHost: savba.savba.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://savba.savba.sk/css/common,login,zhtml,skin.css?skin=harmony\u0026v=260427132613\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 30 Jul 2026 12:06:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 17558\r\nx-frame-options: SAMEORIGIN\r\nexpires: Sat, 29 Aug 2026 13:06:31 GMT\r\ncache-control: public, max-age=2595600\r\nlast-modified: Tue, 07 Jul 2026 09:32:42 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17558,"size_decoded":17870,"mime_type":"image/png","magic":"PNG image data, 646 x 159, 8-bit/color RGBA, non-interlaced","md5":"2ae279fe9cf9754c36ae09a0e0ffefdb","sha1":"c2cc3a3c4f3a655178d31c9050dca9dfc362b9b8","sha256":"cd9f7ba4d4b05e9fa1bbf57d12b039f7d1e61328bb1d76d3deef4c216e5ec0c5","sha512":"13f20eef6be4fc8d1be0224776f0a95534a4283be22e8f888e1e660f3a563b4901db6710d4f4adfcd471f81a8832a216e0faed32dd05b6331666f49fcf93c737","ssdeep":"384:4wx0CAoDq5dgoZzPdgaWYVQtSl5Zq+eYFQxnhLduXRfFvlSahwLXF24Do:Fx0C7q5xjdgiVQtSPpeoblTcXMAo","tlshash":"9f72c074e34bea46a33a633d36b146403e52c12e524309de41c71a743f2951fe99e27e","first_seen":"2023-05-15T04:08:15Z","last_seen":"2026-07-30T12:07:15.945437Z","times_seen":601,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"savba.savba.sk/img/questionMark.png","fqdn":"savba.savba.sk","domain":"savba.sk","tld":"sk"},"ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webmailadminhelpdesk.serveousercontent.com/","date":"2026-07-30T12:06:31.940Z","timestamp":1785413191940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savba.savba.sk","organization":""},"issuer":{"commonName":"GEANT TLS RSA 1","organization":"Hellenic Academic and Research Institutions CA"},"validity":{"start":"Tue, 11 Nov 2025 17:58:48 GMT","end":"Wed, 11 Nov 2026 17:58:48 GMT"},"fingerprint":{"sha1":"A6:8D:59:48:EF:95:00:39:C6:3E:8A:38:6F:3C:BD:7E:50:D0:D6:49","sha256":"89:C5:1A:8F:46:DA:38:1F:35:8B:8A:68:2E:F9:EC:F2:18:62:E3:9E:72:69:08:74:DE:C9:BA:05:C3:BA:D0:AC"}}},"request":{"raw":"GET /img/questionMark.png HTTP/1.1\r\nHost: savba.savba.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://savba.savba.sk/css/common,login,zhtml,skin.css?skin=harmony\u0026v=260427132613\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 30 Jul 2026 12:06:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 5359\r\nx-frame-options: SAMEORIGIN\r\nexpires: Sat, 29 Aug 2026 13:06:31 GMT\r\ncache-control: public, max-age=2595600\r\nlast-modified: Tue, 07 Jul 2026 09:32:40 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5359,"size_decoded":5670,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit/color RGBA, non-interlaced","md5":"5d496d46fe9801cf0e92af8337b3b6af","sha1":"6f9e34028d56b0229759aad8dab4f0c30be30a7e","sha256":"395b89ffffb5b6ea44d2933531396f8d2ae8ff84bae554a1c245d0777af59034","sha512":"1a0c2ff7c5a88ae03d8df8d31473144e969f007ecf4cea45af065770ec3279fb72d3ceb2b28d684becffb65bc60f9681f7c65e503279d8ed4a5aa44132ba9ba0","ssdeep":"96:iDA+MJVudjvxHeroWIEqS9gLNUMvCIRubbiCIdhDdUrEGZ1AkNnlakE:izBjYrdILS0NVtBU11AkrvE","tlshash":"72b18ed0dae8ef886981a95adb2f14e0cb05b15f52fe3cd90b370a0d154f584c53a1be","first_seen":"2023-05-12T15:26:00Z","last_seen":"2026-07-30T12:07:15.946276Z","times_seen":841,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":95,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"savba.savba.sk/img/logo/favicon.ico","fqdn":"savba.savba.sk","domain":"savba.sk","tld":"sk"},"ip":{"addr":"147.213.1.1","port":443,"asn":2607,"as":"Zdruzenie pouzivatelov Slovenskej akademickej datovej siete","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webmailadminhelpdesk.serveousercontent.com/","date":"2026-07-30T12:06:32.097Z","timestamp":1785413192097,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"savba.savba.sk","organization":""},"issuer":{"commonName":"GEANT TLS RSA 1","organization":"Hellenic Academic and Research Institutions CA"},"validity":{"start":"Tue, 11 Nov 2025 17:58:48 GMT","end":"Wed, 11 Nov 2026 17:58:48 GMT"},"fingerprint":{"sha1":"A6:8D:59:48:EF:95:00:39:C6:3E:8A:38:6F:3C:BD:7E:50:D0:D6:49","sha256":"89:C5:1A:8F:46:DA:38:1F:35:8B:8A:68:2E:F9:EC:F2:18:62:E3:9E:72:69:08:74:DE:C9:BA:05:C3:BA:D0:AC"}}},"request":{"raw":"GET /img/logo/favicon.ico HTTP/1.1\r\nHost: savba.savba.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webmailadminhelpdesk.serveousercontent.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Thu, 30 Jul 2026 12:06:32 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1150\r\nx-frame-options: SAMEORIGIN\r\nexpires: Sat, 29 Aug 2026 13:06:32 GMT\r\ncache-control: public, max-age=2595600\r\nlast-modified: Tue, 07 Jul 2026 09:32:40 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":1464,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"8c7d1c14e4b9c42f07bd6b800d93b806","sha1":"87e49826ffb3bc1ddac38feebb6bb98eaef568b2","sha256":"1afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637","sha512":"cd34625876aaf6e8e3cb6da2a9277bab3375cb3515bc701d3a3a05796557c39e442f33c66ae056501c49a810b172a7f6f9c7a32f0b4000ce8472d14ba3e4f41b","ssdeep":"","tlshash":"902152fe66839d2de04c1a7fca7a8a3716cbcd4694e431120b79b209de33c9410e943c","first_seen":"2023-05-02T08:50:11Z","last_seen":"2026-08-01T03:04:56.432801Z","times_seen":3378,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}