Report - correo.ine.es/zimbra/

Report Overview

Visitedpublic

2025-07-16 19:50:16

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
correo.ine.es	unknown	unknown	2017-02-01	2022-12-19	3.3 kB	116 kB	195.254.149.7

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	correo.ine.es/zimbra/	EventHandler	9 B	2023-04-11	2025-08-02
URL correo.ine.es/zimbra/ IP / ASN 195.254.149.7 #200521 Ministerio de Asuntos Economicos y Transformacion Digital Introduced by EventHandler Embedded false Resource Info First Seen 2023-04-11 Last Seen 2025-08-02 Times Seen 2622 Size 9 B (9 bytes) MD5 8330d67045d053b17fa969ef2bdb5e54 SHA1 041174325b27a7b4d2d1b1a0e353fa82d1cb6431 SHA256 ceecf99c8bd1f6e5f89a26d3b40e009d48860d674231297254ff75d817b9a883 Format Code Loading...

	correo.ine.es/zimbra/	ScriptElement	16 kB	2025-07-16	2025-07-16
URL correo.ine.es/zimbra/ IP / ASN 195.254.149.7 #200521 Ministerio de Asuntos Economicos y Transformacion Digital Introduced by ScriptElement Embedded true Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 1 Size 16 kB (16532 bytes) MD5 73e0173faf4d61bb960ac2cccb2742f6 SHA1 fc3e5a96d171312efb41467b5c6acfd24940ee7a SHA256 6d0d179b8a550adcb0035d30e13f6bb38c32227a1a8425b943fc4e380e212e72 Format Code Loading...

HTTP Transactions (6)

URL IP Response Size

GET correo.ine.es/zimbra/

195.254.149.7

200 OK

23 kB

URL

correo.ine.es/zimbra/

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byN/A

Resource Info

File typeHTML document, Unicode text, UTF-8 text, with very long lines (631)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 kB (23318 bytes)

MD5ce015cc8bd0bcdbbd6c1fc99a431c25a

SHA18c5893d73b6ac7c1e00d848a0d23a87a02bb8e5f

SHA256f23afe346570da36ab453f7504a01c46dd5ecf932be911a680a22b363353d357

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /zimbra/ HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 16 Jul 2025 19:49:40 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
X-Robots-Tag: noindex
X-Frame-Options: SAMEORIGIN
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Content-Language: en-US
Set-Cookie: ZM_TEST=true
ZM_LOGIN_CSRF=0217acf0-3d01-41be-858a-956f29722154; HttpOnly
X-UA-Compatible: IE=edge
Vary: User-Agent, Accept-Encoding
Content-Encoding: gzip
Transfer-Encoding: chunked

GET correo.ine.es/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141

195.254.149.7

200 OK

66 kB

URL

correo.ine.es/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byhttps://correo.ine.es/zimbra/

Resource Info

File typeASCII text, with very long lines (751)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size66 kB (65827 bytes)

MD5fb57f982235fdea91c2cebd9a96b3057

SHA12b0616c9f8517b617b9246f28907c3c5647f01a9

SHA256e8929c8bd7cac396d8dc708d260be078ee9bca05d9d062864313a05635d6c0c1

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141 HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://correo.ine.es/zimbra/
Cookie: ZM_TEST=true; ZM_LOGIN_CSRF=0217acf0-3d01-41be-858a-956f29722154
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=2595600
Vary: User-Agent, Accept-Encoding
Content-Encoding: gzip
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Wed, 16 Jul 2025 19:49:41 GMT
Expires: Fri, 15 Aug 2025 07:22:44 GMT
Age: 48418
Content-Length: 13341

GET correo.ine.es/zimbra/img/questionMark.png

195.254.149.7

200 OK

5.4 kB

URL

correo.ine.es/zimbra/img/questionMark.png

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byhttps://correo.ine.es/zimbra/

Resource Info

File typePNG image data, 225 x 225, 8-bit/color RGBA, non-interlaced

First Seen2023-05-12

Last Seen2025-08-02

Times Seen469

Size5.4 kB (5359 bytes)

MD55d496d46fe9801cf0e92af8337b3b6af

SHA16f9e34028d56b0229759aad8dab4f0c30be30a7e

SHA256395b89ffffb5b6ea44d2933531396f8d2ae8ff84bae554a1c245d0777af59034

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /zimbra/img/questionMark.png HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://correo.ine.es/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141
Cookie: ZM_TEST=true; ZM_LOGIN_CSRF=0217acf0-3d01-41be-858a-956f29722154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: image/png
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=2595600
Last-Modified: Mon, 10 Feb 2025 12:02:32 GMT
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Wed, 16 Jul 2025 19:49:41 GMT
Expires: Fri, 15 Aug 2025 14:05:08 GMT
Age: 24274
Content-Length: 5359

GET correo.ine.es/zimbra/img/new-back-ground-image.png

195.254.149.7

404 Not Found

937 B

URL

correo.ine.es/zimbra/img/new-back-ground-image.png

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byhttps://correo.ine.es/zimbra/

Resource Info

File typeHTML document, ASCII text

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size937 B (937 bytes)

MD50bf57e62c92dab5fb0ca597b340e3d55

SHA13242be1d9613169479f3ae310a7a3e4ed780e05d

SHA256c46297d8ed07a6bcffc7c6d430a485db463b0d3d6bd9e7471ba43c493acdb9de

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /zimbra/img/new-back-ground-image.png HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://correo.ine.es/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141
Cookie: ZM_TEST=true; ZM_LOGIN_CSRF=0217acf0-3d01-41be-858a-956f29722154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 16 Jul 2025 19:49:41 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 937
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Cache-Control: must-revalidate,no-cache,no-store
Content-Language: en-US

GET correo.ine.es/public/logos/logo-fuera.png

195.254.149.7

200 OK

18 kB

URL

correo.ine.es/public/logos/logo-fuera.png

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byhttps://correo.ine.es/zimbra/

Resource Info

File typePNG image data, 440 x 168, 8-bit/color RGBA, non-interlaced

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size18 kB (17786 bytes)

MD5bf04a2a95829471710adc5ea72535496

SHA1b4d9087f7fcc27c7d9d3d23a16aafc6a44fd6bd7

SHA2566d64f3721ef4ade2fb2b3670d1f65c8b7acdbe4dfd9fa063f856a54bd53cac68

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /public/logos/logo-fuera.png HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://correo.ine.es/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=250210122141
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: image/png
X-Robots-Tag: noindex
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=2595600
Last-Modified: Mon, 07 Apr 2025 12:00:56 GMT
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Wed, 16 Jul 2025 19:49:41 GMT
Expires: Fri, 15 Aug 2025 17:29:51 GMT
Age: 11991
Content-Length: 17786

GET correo.ine.es/zimbra/img/logo/favicon.ico

195.254.149.7

200 OK

1.2 kB

URL

correo.ine.es/zimbra/img/logo/favicon.ico

IP / ASN

195.254.149.7

#200521 Ministerio de Asuntos Economicos y Transformacion Digital

Requested byhttps://correo.ine.es/zimbra/

Resource Info

File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

First Seen2023-05-02

Last Seen2025-08-02

Times Seen2144

Size1.2 kB (1150 bytes)

MD58c7d1c14e4b9c42f07bd6b800d93b806

SHA187e49826ffb3bc1ddac38feebb6bb98eaef568b2

SHA2561afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637

Certificate Info

IssuerFNMT-RCM

Subjectcorreo.ine.es

FingerprintBE:86:5C:FC:C9:81:1A:BC:BD:C9:79:3A:77:DC:BF:10:67:BE:27:03

ValidityTue, 08 Oct 2024 05:12:16 GMT - Wed, 08 Oct 2025 05:12:16 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /zimbra/img/logo/favicon.ico HTTP/1.1
Host: correo.ine.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://correo.ine.es/zimbra/
Cookie: ZM_TEST=true; ZM_LOGIN_CSRF=0217acf0-3d01-41be-858a-956f29722154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: image/x-icon
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=2595600
Last-Modified: Mon, 10 Feb 2025 12:02:32 GMT
Accept-Ranges: bytes
Connection: Keep-Alive
Date: Wed, 16 Jul 2025 19:49:41 GMT
Expires: Thu, 14 Aug 2025 22:56:14 GMT
Age: 78808
Content-Length: 1150