{"report_id":"074925af-2028-40dc-855a-2570251540e7","version":6,"status":"done","tags":["meta","facebook","phishing","social"],"date":"2025-08-06T01:41:24Z","url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"title":"Meta for Business - Page Appeal"},"submit":{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-10T01:41:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"summary":[{"fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-08-05T14:49:45.018892Z","last_seen":"2025-08-05T14:49:45.018892Z","alert_count":12,"request_count":12,"received_data":1413004,"sent_data":6539,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"20cd36b66b3be34d29bffd9bba8455ac","sha1":"7db0160f4cb84b19b88b87de0bab1f3cd050f3ad","sha256":"11a7ed47dbf8445aaf73febd74fffd3bd792eb4d0fe5ce1208903386d57ccd70","sha512":"1c9dc1972a38d2f44c1cc62ea3ae4d10dfd8367f2e69b74bbd2312ccfef7af5ebea5aafe1e848d93e2a3317719e2dc4a35a363f2abf1fa54369fdb79a5c84124","ssdeep":"","tlshash":"04d0c2ce1551428227e741239b13720a743320ee8c0ae8401a02d2506f2935f537bbef","size":279,"data":"","first_seen":"2025-08-01T14:36:41.643167Z","last_seen":"2025-08-23T14:24:24.244573Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d5636231524376f0f3c1ae72385bb1b","sha1":"56107e07bc2c6cec7b7c7b7d4d3aef785bda6960","sha256":"fb2678629994efb9abc978523ab6c4fa4fe5a7a6b03be8d7229597820d6c8485","sha512":"343d9bbb4c5bf0ac244cd78aa3b1b8e37e053ad59dd2d844f791fb6ce5b76c7dca329daf43e1c5abcf467ab752150702d51f22088af8c4a05fca9733d4a6db69","ssdeep":"","tlshash":"02c08c8c210b0c7051e72a010b7fa204b00a3212a490ee302a0a63044f20e03db44814","size":162,"data":"","first_seen":"2025-05-21T09:34:29.878997Z","last_seen":"2026-05-19T04:05:01.855573Z","times_seen":374,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9635c3097d7689f53eefca66898a5709","sha1":"42d75e2389834a1fb2de139f363b1b72242e38e9","sha256":"4ca63527eeb22be51e6040b7cd51c7b1c0fc199b97a5681db70744cdd8e4a938","sha512":"9af44a19eef053ef21b28f7b79ed955863adcf093461604f0e070c8ea7893ecfd863014644f22b9c4277ea96097ef675db8065002ad2e7a9b5b1b10123ab47f9","ssdeep":"384:6OOcKa9gg3QDSPS9l5cNrN0Li+iBiPi4ifiViKini8ini2iSi6isi1isimiN5N84:6diCSPS9lGR0uPIKVaEzixiH7jhkh3Nj","tlshash":"ba82fa5b92f7253146bf91ab97eb11073531500b3642ce007eac43481f99ea396f6bbe","size":19054,"data":"","first_seen":"2025-08-01T14:36:41.641062Z","last_seen":"2025-08-29T20:21:41.499792Z","times_seen":72,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"246cdd9342d6df668fd36e314d7a3ffd","sha1":"e7f22a012295f5927074845f8556da9e50390261","sha256":"6e9718d5fbecd8e2f158db327e1e58f2b865bec456b59f058c0b8c65a91ac0b6","sha512":"4e4df852fac01c666fff9f5c3c7e90617b3d87ff9c9ca6be8d716e8849ee23d8c8d1db611f85be8e47727732654e83a74c0afc972ce5c13668060d53824ff3e4","ssdeep":"1536:5wkcpyQYq19XxReciupZvKST0VFsBbGFCVvzBT11EUD97cuqmSIC7HQBEUNpyFx6:G/Uq1d3B2IC7HQBEUSFKyI","tlshash":"b4e3300a33f56432425bb07a592fc60ab335a4472a4aad0c3e5c56dc5f1d87867f2fb8","size":152281,"data":"","first_seen":"2024-02-15T03:47:53Z","last_seen":"2026-06-13T17:35:33.351557Z","times_seen":15221,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/jquery.min.js.download","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-24T07:36:58.8028Z","times_seen":190872,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f94b8e84e1b334f63c2ae0e113f4aba1","sha1":"535e9bc3bcfe3c70a6e741cc4d4e0e43daa558e1","sha256":"05b542e596c66dff6cae5f23d6fdba48b241a508fffca89e25d132fdb401b932","sha512":"1932a933f162a8a04859b7446c83e3dee6aa3ad76b417c17aed3de3bafaec9134b06d224332b276f02768a285f2d81da6bd2031eda2d76edc3230a06d1e3e16d","ssdeep":"","tlshash":"c831787a86771a3007bfb27667df778c3931000b7102da097e2c86884fe0d5158668ee","size":1514,"data":"","first_seen":"2025-05-21T09:34:29.882007Z","last_seen":"2025-11-01T02:25:50.198498Z","times_seen":361,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6768310d509ca30ce218c370efae8765","sha1":"190773da6402ae6c3b4d609125a035fa4aefdb8c","sha256":"7753b98e581c6a9ddbe9fc96f7a4ae7144cc3e27b0703167aaefbb756d77b7a0","sha512":"9e594e204183bb6d4ed441b6be892c045970f7fb57744059bf72747be71cd665e8ca1152840447c720104cd41f02cdd799587d337941a4f045bbae0c901c84bd","ssdeep":"","tlshash":"6351aa9d25f721390d53a9bc2bcbc102b32150636c488d5affac50427f82f286af5ad9","size":2648,"data":"","first_seen":"2025-06-12T09:36:10.549231Z","last_seen":"2026-05-19T04:05:01.858525Z","times_seen":373,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/js","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f320631f4c3234d1bb62e1431fe9a66a","sha1":"cedfaafd5ac27cbde6c635141062dfde01320237","sha256":"cc2257fb7c656f1604ad49b49bac4b5f40844fda8a1ad3fb376318a4846b3c89","sha512":"00952be812d5a5f5e13cee595d5dbdd113743c1566e114558dc07bf242a0b1c9af80ce9bf963f4ad523ca4d02f204642cb9454c4dfe9ce387ad9c1c542cdbec6","ssdeep":"6144:04Em9yIJDtxa94GpUs6hNsx2wE3OPoK/UI+72jAYqmj6:dEYJZ49tANsAel+7vm2","tlshash":"de6419ce73c674269296e478507f028ba57b28a2b44cc8d5f1c9cce42d74a9a4277f7c","size":335473,"data":"","first_seen":"2025-02-12T19:04:21.315034Z","last_seen":"2026-05-19T04:05:01.850955Z","times_seen":869,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-06T01:40:44.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /plekdsoqwxn3sa.html HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5849\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"plekdsoqwxn3sa.html\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 06 Aug 2025 01:40:44 GMT\r\netag: \"d4d7103211116f4426c5843f213662b1\"\r\nlast-modified: Wed, 06 Aug 2025 00:03:15 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pptbv-1754444444723-b80749514021\r\ncontent-length: 753\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1371,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"d4d7103211116f4426c5843f213662b1","sha1":"00d5c75f0e3bdabce2e0ecf7b4a5d3c56880c0c5","sha256":"c1c8abf9cc39bad3eeb50205494a8e5d9490556f220a087a98b8cf19dcb51aad","sha512":"d5d2d6819ae4f26d289107285e4398dc2283593939a33f456cb722fdbf669608e1beccaa89b9860b7d32ba344ef8c353bbf8c266da5d3aed691f5975c7836d87","ssdeep":"","tlshash":"dd2131590582441902b282717fe23024e377d4eb4b0e8d9479db60af7fb630ac1677d9","first_seen":"2025-08-01T14:36:41.634708Z","last_seen":"2025-08-23T14:24:24.236572Z","times_seen":18,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":31,"dns":5,"connect":1,"send":0,"wait":10,"receive":25,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/ico.ico","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","date":"2025-08-06T01:40:45.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/ico.ico HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 4354\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"ico.ico\"\r\ncontent-encoding: br\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Wed, 06 Aug 2025 01:40:45 GMT\r\netag: \"6701a4ba0b931af579be35b93631da04\"\r\nlast-modified: Wed, 06 Aug 2025 00:28:11 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::8hv5z-1754444445079-fc9cad49e40e\r\ncontent-length: 909\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"6701a4ba0b931af579be35b93631da04","sha1":"c8161484acccdd0cae1cd6484f56942cb7ffd7dc","sha256":"ce8a22ece441cfd0f09fb0359b8d683fed0e66f8bec0bbc067a8257c95b05fd8","sha512":"c09e65509b04f904bb74c8aa78c099f4d195426293711f5eb6f3c47d6c27b9c278898cfd718fafa5418e40498b7904d818a8dd654a956694550d0b43048151c2","ssdeep":"24:Eg5ed8vZa+/kffJTyN5J5iXSvjTxatgFFjiZq1MJMaDgD6VDcl2HPwFf5zaTrZ4l:yfqHUs6hcEI5KrZ4jaJV9HxG8Q","tlshash":"55b1aca0b2931348f4f811b0c343748d7bec2c438ca25a53a6bb3acd5dfc19892531d2","first_seen":"2023-12-25T05:22:02Z","last_seen":"2026-08-24T06:34:56.011044Z","times_seen":14049,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/bootstrap.min.css","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/bootstrap.min.css HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 111524\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"bootstrap.min.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"6d5ef83be602f2aea051ab5ed654063a\"\r\nlast-modified: Mon, 04 Aug 2025 18:42:04 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::sh5j7-1754444449054-fc6ffbd0688d\r\ncontent-length: 27118\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":185718,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (334)","md5":"36581add4e867d6e7ac88d55a52f71d1","sha1":"1f6dc2557ad818ab81003eaad98e5215729ebc09","sha256":"f75ceff2e3cda02528b86d03a4558d36be41596be85c85677e8c1265a3084d65","sha512":"e24b7989cf9f14f0d9339f87533725c0faee0763c8e0d664214f51389579c4fc34f2ff70f336a4be288c37bf26dfd8906c9ae68718b172f7dac982eed3d43c35","ssdeep":"1536:7oo0pe3VX8IFqCvnUEE9RMPenjyCFeDm9M5FKBnpNfL:7Ae3CxM5FKBnpNfL","tlshash":"45045499fdf128085a178558a443bbf97b2d1085b709ee79f4a33651e3883c1e4f3e89","first_seen":"2025-05-21T09:34:29.860117Z","last_seen":"2025-11-01T02:25:50.179898Z","times_seen":312,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/jquery.min.js.download","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/jquery.min.js.download HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5336\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"jquery.min.js.download\"\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"2c872dbe60f4ba70fb85356113d8b35e\"\r\nlast-modified: Wed, 06 Aug 2025 00:11:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pptbv-1754444449055-4636a9e7eba6\r\ncontent-length: 32127\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87533,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-24T07:36:58.8028Z","times_seen":190872,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/style.css","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/style.css HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 71676\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"style.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"9a4e5787a256f4b3ff8534afd4954f81\"\r\nlast-modified: Tue, 05 Aug 2025 05:46:12 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zjcn5-1754444449056-373ce54f4f9a\r\ncontent-length: 5664\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21517,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"2b7b7b9ab6091c32ad2dadc996719c76","sha1":"522a2b5c986557eb02fc2a15cae65e4b517a32b8","sha256":"f3b2ba506d1f9b7cdab6ab68106896c3becc23919850fe55e8b953fafeac64e7","sha512":"acbbc80475ea9113fa9a89ebc0322627e1d471f4954705daa6c23736bfafbd756d2e3a562208cde7a03c4f1617acc980130585de7e0d3e7ff2b4928d18b07a31","ssdeep":"384:QoqnEgpqFcKhF5V8vxvYFJueR3y9P4vlj68VJR6xytzPxl:Q+FcYFOyFJu+3y9P4vN68VJR6xytzPxl","tlshash":"8aa262825ea71505b51a85683bfadf4a735a8443910ecdbc7fd8328c8f892d4e5b27cc","first_seen":"2025-05-21T09:34:29.85693Z","last_seen":"2025-11-09T14:44:03.302621Z","times_seen":315,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/img/meta-logo-grey.png","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /img/meta-logo-grey.png HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 18934\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"meta-logo-grey.png\"\r\ncontent-type: image/png\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"ffba640622dd859d554ee43a03d53769\"\r\nlast-modified: Tue, 05 Aug 2025 20:25:14 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::cx784-1754444449058-e6ee022f87aa\r\ncontent-length: 105511\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":105511,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 900 x 240, 8-bit/color RGBA, non-interlaced","md5":"ffba640622dd859d554ee43a03d53769","sha1":"c91a100db7bfc04df9a5f3223d5b6f17536bf5ee","sha256":"139d38d0fbfed2fd9f2b782af9b3eb08005b9bc75faaa31fe29720cc64bcab0f","sha512":"70c7c4df14a22e00a0caf1daf001e608454604fa0b4c13583efac7a8caff6c726d62c024f9e0626760b524f7d08184e4e30cf4a49be505acb1f9d29cfce35993","ssdeep":"1536:VudXKa4pprle5L3Ve48HXzXl4F4fTy9AeC9hhxVK0cYUFLWyMjmy/Yu:/xe5UHDaCTy9bmPJURWBjma","tlshash":"efa3022ee1d5311eced3515032d47e985a86ace5cf421c08758cca9b8f34e994aed3ea","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-24T06:34:56.008504Z","times_seen":16045,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/img/Mate.mp4","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html","date":"2025-08-06T01:40:44.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /img/Mate.mp4 HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 4358\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"Mate.mp4\"\r\ncontent-range: bytes 0-292265/292266\r\ncontent-type: video/mp4\r\ndate: Wed, 06 Aug 2025 01:40:45 GMT\r\netag: \"10b6a79b6905a100feb12b61fed435b8\"\r\nlast-modified: Wed, 06 Aug 2025 00:28:06 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::gtdw9-1754444444986-6678d542a32a\r\ncontent-length: 292266\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":279132,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"e6c57e4563b0a6783d81a955d37c586d","sha1":"0f61d50b5a6f33afdb7892ad500d9b9387a9670e","sha256":"e8b5ab7a05b66fe28990f56c478137f356a343294aa2129dd3c1d91a079510ea","sha512":"e3f64c1ec67c1f7dddc0ce6737ab7cd13a2c3184f0838d250d89339c480a94bacd56e84d0ddd544692928d6a41eda2658d0003b3385e39676c52de0b712c650c","ssdeep":"6144:E/I+AeDkczPdLzS93F84WbJcbULlHZkO/+b8ffur4+8SpU2:E/LAeDU1F8C4xl+A+rb8Su2","tlshash":"545423aab3dc7205cf748a39c04dc325e26cfa4a6a5a1bf7a0c17e47111605ace9c37d","first_seen":"2025-08-06T01:41:25.713809Z","last_seen":"2025-08-06T01:41:25.713809Z","times_seen":1,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-06T01:40:48.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /case/1006RKLM22UFRI86168.html HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/plekdsoqwxn3sa.html\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5336\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"1006RKLM22UFRI86168.html\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 06 Aug 2025 01:40:48 GMT\r\netag: \"045bddbe898be3849696c14f0f46f41f\"\r\nlast-modified: Wed, 06 Aug 2025 00:11:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::kcxx4-1754444448956-503802d51f36\r\ncontent-length: 45598\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":221571,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (617), with CRLF line terminators","md5":"711b5e05e38041d2e94b904be7647e64","sha1":"44df5c090ed5f9d0252eba508ce9628ca6dc0d07","sha256":"90039ea58cc9ae93f3a228526a39f573db779f0c0c7b6d706849a6518777657f","sha512":"e7a44c4f659c51ee6163411e294db2500d615030132643a8aec0ed5177c548e7e9d901fe3e6aa1182658df78c3f72bb605a9099a4c8df358f5466d28679d0473","ssdeep":"6144:HTwnfXwUPCPGohD7pC9qfII+JI4XLPm1upnFNmEtrUei2NYDF2V/dYIzZRflwu8S:YqfII+JI4XLPm1upnFNfDi2SF2V1YIz3","tlshash":"e224c71a3394243b4177a37a9e37860afb365667524341093ebc56dc0f3ac6192b3fb8","first_seen":"2025-08-01T14:36:41.628822Z","last_seen":"2025-08-06T01:41:25.719133Z","times_seen":10,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/ico.ico","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/ico.ico HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 4358\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"ico.ico\"\r\ncontent-encoding: br\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"6701a4ba0b931af579be35b93631da04\"\r\nlast-modified: Wed, 06 Aug 2025 00:28:11 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pptbv-1754444449274-53ff919dc5aa\r\ncontent-length: 909\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"6701a4ba0b931af579be35b93631da04","sha1":"c8161484acccdd0cae1cd6484f56942cb7ffd7dc","sha256":"ce8a22ece441cfd0f09fb0359b8d683fed0e66f8bec0bbc067a8257c95b05fd8","sha512":"c09e65509b04f904bb74c8aa78c099f4d195426293711f5eb6f3c47d6c27b9c278898cfd718fafa5418e40498b7904d818a8dd654a956694550d0b43048151c2","ssdeep":"24:Eg5ed8vZa+/kffJTyN5J5iXSvjTxatgFFjiZq1MJMaDgD6VDcl2HPwFf5zaTrZ4l:yfqHUs6hcEI5KrZ4jaJV9HxG8Q","tlshash":"55b1aca0b2931348f4f811b0c343748d7bec2c438ca25a53a6bb3acd5dfc19892531d2","first_seen":"2023-12-25T05:22:02Z","last_seen":"2026-08-24T06:34:56.011044Z","times_seen":14049,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/styles/js","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /styles/js HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5336\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"js\"\r\ncontent-encoding: br\r\ncontent-type: application/octet-stream\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"f320631f4c3234d1bb62e1431fe9a66a\"\r\nlast-modified: Wed, 06 Aug 2025 00:11:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::czdlc-1754444449056-395d70816964\r\ncontent-length: 114309\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":335473,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (5960)","md5":"f320631f4c3234d1bb62e1431fe9a66a","sha1":"cedfaafd5ac27cbde6c635141062dfde01320237","sha256":"cc2257fb7c656f1604ad49b49bac4b5f40844fda8a1ad3fb376318a4846b3c89","sha512":"00952be812d5a5f5e13cee595d5dbdd113743c1566e114558dc07bf242a0b1c9af80ce9bf963f4ad523ca4d02f204642cb9454c4dfe9ce387ad9c1c542cdbec6","ssdeep":"6144:04Em9yIJDtxa94GpUs6hNsx2wE3OPoK/UI+72jAYqmj6:dEYJZ49tANsAel+7vm2","tlshash":"de6419ce73c674269296e478507f028ba57b28a2b44cc8d5f1c9cce42d74a9a4277f7c","first_seen":"2025-02-12T19:04:21.315034Z","last_seen":"2026-05-19T04:05:01.850955Z","times_seen":869,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/img/fb_round_logo.png","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /img/fb_round_logo.png HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5336\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"fb_round_logo.png\"\r\ncontent-type: image/png\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"81bb5cf1e451109cf0b1868b2152914b\"\r\nlast-modified: Wed, 06 Aug 2025 00:11:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::kcxx4-1754444449057-03c2d0e2631b\r\ncontent-length: 42676\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42676,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"81bb5cf1e451109cf0b1868b2152914b","sha1":"b70017639afc079394be1ea8625f7c4beb44d617","sha256":"676c83478e410d324fe56aca428d3305505732c648667b22e15c8222117c75e6","sha512":"1782966b78f57cc91392f3ff03f05d37e0a5fd8b04b0997b2ef708d13c162ea4aad607e7705a36e0539d6a6b60337432ef271bff062f7170018b42c9b8b81de6","ssdeep":"768:QJ6R1m5mLWd4WdvyQqjv9YRNt2ZDmzqSqBoruj6f3drrFpY85JW81Cl1xB+aArel:QJ41emLWxdv7C8Nt2UzqSuu46v9rvY8I","tlshash":"b613f1da546bcdfec2f950b418ffe653f43ad07b1a8c446fe644eca2ec518a024e2641","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-24T06:34:56.005079Z","times_seen":16103,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/img/2FA.png","fqdn":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","domain":"1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html","date":"2025-08-06T01:40:49.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Tue, 24 Jun 2025 04:57:32 GMT","end":"Mon, 22 Sep 2025 04:57:31 GMT"},"fingerprint":{"sha1":"81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7","sha256":"CF:7D:EA:B1:F6:D3:8D:F4:F7:DA:1F:83:F1:44:C8:1D:E2:58:46:A5:3A:AD:9E:5F:79:E0:C3:92:23:CE:2D:B7"}}},"request":{"raw":"GET /img/2FA.png HTTP/1.1\r\nHost: 1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1006rklm22ufri86168-ggew3g33-hiep04us.vercel.app/case/1006RKLM22UFRI86168.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5336\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"2FA.png\"\r\ncontent-type: image/png\r\ndate: Wed, 06 Aug 2025 01:40:49 GMT\r\netag: \"03d39d5d071182aba1b01ba2e859de39\"\r\nlast-modified: Wed, 06 Aug 2025 00:11:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::sh5j7-1754444449059-7c3a6b3856cc\r\ncontent-length: 114767\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":114767,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 541 x 252, 8-bit/color RGBA, non-interlaced","md5":"03d39d5d071182aba1b01ba2e859de39","sha1":"7ba8f968b03e92fd59a6c4f6ce5c8aa36a5d2b92","sha256":"a7fd65363687e512751d88f7850b61969427e8d3aa9a177946bcd4bc280b71ad","sha512":"5bf4d0b9ff650ff11c8ff69c409c45fbfd31bc3f8c4b55f665bea8e11a42c412b9ea25b9974908ab9b670a22e80a445692a26b98535b84cb49299c37c22e16e6","ssdeep":"3072:SOEFifYmNYKElSiLVN6MOzKqJdnJYJe4kiUh6sq:SIZYKEzmXZdJ8eYx","tlshash":"3cb31251b4a03e28e812f3ea73d7f49a4c71e374785d41a294047ec7e72da56f04afa4","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-24T06:34:56.002972Z","times_seen":9923,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}}]}