[TomAnthony]

The negative test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640187792DOH...

The positive test result:

https://pcr.euprava.gov.rs/validate.php?cqcode=1640524880jk8...

[grujicd]

This is very sad development for me, Djokovic's countryman who really bought his story. Nut facts are facts.

I can share my own (positive) test, which confirms timestamp and id theory. My test was taken on the 7th January, it was a rapid test, not a PCR. But it's in the same government database:

https://pcr.euprava.gov.rs/validate.php?cqcode=1641591150Q!A...

Timestamp: 1641591150, which translates to GMT: Friday, 7. January 2022. 21:32:30. That seems to be right, it was taken earlier on the 7th and probably entered later to the central database.

Also, ID of my test is: 7601263. Djokovic IDs are 7371999 (16/12 test) and 7320919 (22/12 test).

It really looks like IDs are incremental, and that his test that was supposedly taken on the 16th was taken on the later date.

One consolation fact is that he wasn't positive when he took photos with kids on 17th.

EDIT: I messed up and copied Novak's QR url! fixed now!

[grujicd]

Ok, this is getting strange. There are two ways to get test results:

- it's automatically sent to email (if they have it)

- you can download it from ezdravlje.rs portal

The test I shared above is the one I got on email. However, I went to portal, downloaded pdf, and now I have two copies. They're different! IDs and all the data are the same, but QR codes are different.

This is the new one: https://pcr.euprava.gov.rs/validate.php?cqcode=1641923234g3D...

Timestamp on new pdf is: 1641923234, which is GMT: Tuesday, 11. January 2022. 17:47:14

So it appears that timestamp is related to when pdf is generated, and when you download it from the portal it's generated at that point of time, i.e. there are no pdf documents sitting on government server!

So this timestamp is definitely no proof of forgery. But test ID might be - that one is still suspicious.

And one more thing, when I switch tabs with my two QR codes - page content is the same but shifted a bit. I didn't look into html/css to see what's different.

[meelosh]

The question I have is this - is the test ID generated when the test results are generated for the first time (either sent by email if they have it, or accessed through eGov or eHealth portal), or are they generated as soon as test results are complete? If it's the former, then it's theoretically possible that the first (positive) results have been downloaded for the first time on Dec 26, and thus have a higher ID number.

Unfortunately, no data points from me, even though I have been tested MANY times due to my profession. They've got my email, so they obviously get generated immediately.

However, I do have a data point for screenshots when QR code of the positive test stated that the result was negative. This is something that happened to me as well (back in 2020, once, and never since then). It was a bug, obviously. The second part of the ID is person-specific (all my test results have that second part identical, regardless of when they were taken) - it seems that if a positive test is followed by a negative test, that happens sometimes.

[crnigruja]

Additionally, on Novak's PCR test from Dec 16th on the website, the test result "NEGATIVE" had been changed to "POSITIVE" sometime around 14h00 on January 10th. Noticed by several people, including myself (took screenshot even myself before and after).

BTW, apparently my IP address has now been blocked accessing to that website :) I get this message now: "Ваша адреса је блокирана 24 сата! Vaša adresa je blokirana 24 sata! Your address is blocked for 24 hours!"

[raegen]

Skipping the part where I discuss my general doubt of intellectual capabilities of the fellow commenters here.

- Datum uzorkovanja (Date of sampling): 22.12.2021 14:12:10

- Datum izdavanja rezultata (Date of issuance of results): 22.12.2021 16:15:49

=> I will ignore the time needed to get the actual swabs to the laboratory and do the necessary paperwork etc and round this to ~2 hours of time available for testing.

- Vrsta analize i proizvodjac testa (Type of analysis and test manufacturer): Real Time PCR test-SARS-CoV-2, , Sansure Biotech INC; Hunan Province

See, unless my fellow countrymen have developed a way to do PCR tests 5 times faster than the fastest tests available in the (rest) of the world, this test in itself is a joke. This is the reason PCR testing: costs, is usually indicated by symptoms already present/positive antigen test.

You're welcome.

Take care

[panarky]

Unfortunately the Serbian registry doesn't provide a timestamp for when each test was taken.

But our intrepid OSINT researcher discovered that the data in the QR code begins with a UNIX timestamp, such as cqcode=1640187792... and cqcode=1640524880...

From that one might infer that the positive test actually happened 4 days after the negative test.

The documents Djokovic provided to the court claim the positive test happened 7 days before the negative test.

[revax]

The timestamp seems to refer to the time the test report was downloaded not when the test was conducted.

https://twitter.com/blokovi/status/1480945535620108296

[hanoz]

Is there any reason to assume this timestamp represents the time the test was taken, rather than, say, the time the certificate was generated?

[kleton]

'Цовид-19' has to be one of the laziest transliterations I've ever seen. Coronavirus is spelled with an initial К in every Cyrillic-using language I'm aware of, not a Ц (ts) sound in English. It's basically a keyboard IME transliteration, since in Serbian, "c" would be the Roman equivalent of "ц".

[disabled]

Yep, Serbo-Croatian (technically Bosnian-Montenegrian-Croatian-Serbian) "K" for "koronavirus". The only difference between languages is Latin versus Cyrillic.

Croatia, for example has its official coronavirus webpage as https://koronavirus.hr

[hanoz]

I've just managed to get my ip address a 24 hour ban by tweeking the timestamp parameter once! Which is a pretty obvious DoS vulnerability if anyone wanted to disable a venue's pass verification ability.

[brokenmachine]

How does that become a DoS? Spoofing ip's to get banned? Wouldn't you have to know the ip's that you wanted to get banned?