{"report_id":"0c3daee0-2ee4-4f5b-8054-307515f698f8","version":0,"status":"done","tags":["meta","facebook","phishing","social"],"date":"2026-10-13T15:48:40Z","url":{"schema":"http","addr":"facebook-secure-my-account.brothersexpeditions.com/","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"77.37.55.66","port":0,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"final":{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"title":"Log into Facebook","dom":{"size":4492,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0656c149bf4a52568822a6b5add7731d","sha1":"8f5480450aacfe4fa402b4c02126e63295c85e10","sha256":"cec087b53896a7c8bf565f98c755d4c03f9062cce39bf85734f7f04f09b81831","sha512":"8221aa035c31444850e1cf80dc6223cf96fd26f1c61e79018a7f511b20aa9064a0bff8dbd9e5120c69d2f90af634b8ec1c28353442d1d938a6f36a91594c218c","ssdeep":"48:nBSE+cHY4DfX/LerlXju7F9fzGReppq+Txjo1k/KvUN9aSYX+iGqGTGFlq8aUdHf:nBS9CgjuR90eq+ry3IzU+sMT2Igi83","tlshash":"6991b42570f5083b059382e9b3d3ba293dd68003e5099814b6fc0b5a9fe6f065c236ee","dom_hash":"domhash9fe410685cbec97e0a5c2daec93ab41d","first_seen":"2026-10-13T13:41:39.359417Z","last_seen":"2026-10-13T15:48:40.637931Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"facebook-secure-my-account.brothersexpeditions.com/","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"77.37.55.66","port":0,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-17T15:48:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"summary":[{"fqdn":"facebook-secure-my-account.brothersexpeditions.com","ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"domain_registered":"2024-01-09","domain_rank":0,"first_seen":"2026-10-13T13:41:36.346295Z","last_seen":"2026-10-13T13:41:36.346295Z","alert_count":24,"request_count":6,"received_data":228018,"sent_data":3365,"comment":"","tags":null,"fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]},{"name":"PHP:8.3.35","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"introduction_type":"scriptElement","is_inline":true,"md5":"0a4527d17448e8cfd36467cb97b7f3c8","sha1":"2a8e92a7707f10396074f0b936a788e6790a9db9","sha256":"10d7aa9af43f92a8c1cae63fca633868313d6818bdc31b8b9e6dfc9e64560582","sha512":"9cbbb8f71b4b942a37d33acfccc6c329180bafb5c9eeb3b58664b00313c0063631383fcbefcea236c5257ab65838b90572cab959ed69f05d8d7a17d1a29830b3","ssdeep":"","tlshash":"4f31313b38f709251da3b4be53c3b1007226a0033995da65bedd03085f58e262d23bc7","size":1533,"data":"","first_seen":"2026-10-13T13:41:39.373717Z","last_seen":"2026-10-13T15:48:40.642999Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T15:48:10.990Z","timestamp":1791906490990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.3.35\r\ncontent-encoding: br\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\nvary: Accept-Encoding\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: 9042e35e59a2b69205034b108f14e8f6-bnk-edge7\r\nx-hcdn-cache-status: DYNAMIC\r\nx-hcdn-upstream-rt: 0.150\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]},{"name":"PHP:8.3.35","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":4501,"size_decoded":2378,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"3f4a7318bfab4d39338f677a8e828917","sha1":"9e976fe799b68096def60dcf72c6414dc0233d14","sha256":"9b8139bb40ca05ef9b64f5ee6c0b61cc2d961e34cb22e2d312b8aaccaf9ec15f","sha512":"3fd8559ec0b3bb4c81ca667abc785bcc752133a5c7c9c6e0fb2b221153054d0d15c86ce86a59d5207754e6fcedf40dda3d3d198814843d20ead4e291dc153176","ssdeep":"48:xSE+cHYLDfX/LerlXju7F9fzGReppq+Txjo1k/KvUN9aSYX+iGqGTGFlq8aUdHNx:xS9vgjuR90eq+ry3IzU+sMT2Igi8IM","tlshash":"4f91b42574f5087b059382b9b3d3bb293dd68043e6499814b5fc0b4a9fe6f065c236ee","first_seen":"2026-10-13T13:41:39.368843Z","last_seen":"2026-10-13T15:48:40.638731Z","times_seen":3,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":43,"connect":23,"send":0,"wait":174,"receive":0,"ssl":56},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/style.css","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://facebook-secure-my-account.brothersexpeditions.com/","date":"2026-10-13T15:48:11.496Z","timestamp":1791906491496,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebook-secure-my-account.brothersexpeditions.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: text/css\r\ncontent-length: 1453\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 19 Oct 2026 23:41:23 GMT\r\nlast-modified: Mon, 12 Oct 2026 23:41:15 GMT\r\netag: \"1497-6acd701b-b3e55726cb5897a;br\"\r\ncontent-encoding: br\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\nage: 7623\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: ead32ad3fb45c224905bfc6a7ccb4d77-bnk-edge6\r\nx-hcdn-cache-status: HIT\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]}],"data":{"size":5271,"size_decoded":1994,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"d3f22ae67129fbd849f79cfd08a1fd9a","sha1":"dc7524517df82149b89ecd50c28ff589238097ad","sha256":"3d4967c6133c3c37ed3d5839202fac71c545372e87d12a2df50957dfe667595e","sha512":"b4c9f475a946b1686fc9d8f76106bd0a8123403778a8828d91eb0b6fad881853130be0a97af83f8557efb13f10a7d1918f3fea7e3bab92c7bb18c84e3ecc5d2c","ssdeep":"96:IJlB8PIM5CQTCF5ChCfrVbnwdxqfcBgZxinxt1oexTC7xWmJajFSCEo8nkh1R4o:0lBBQOFcUJiYqpEoBhLl","tlshash":"1bb10fca6e6a12027946c8787a624b47f35c8403820fe96d7ee0105ccfcd3959abe7dc","first_seen":"2026-10-13T13:41:39.37164Z","last_seen":"2026-10-13T15:48:40.639582Z","times_seen":3,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/img/fb-logo.png","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebook-secure-my-account.brothersexpeditions.com/","date":"2026-10-13T15:48:11.505Z","timestamp":1791906491505,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET /img/fb-logo.png HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebook-secure-my-account.brothersexpeditions.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5240\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=604800\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: 8485a4d928959a58ec3687051dec31fc-bnk-edge6\r\nx-hcdn-cache-status: EXPIRED\r\nx-hcdn-upstream-rt: 0.141\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]}],"data":{"size":5240,"size_decoded":5641,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"562b9cc5c64ffca7700363756f2bb8df","sha1":"2f495aebcb2f4424a2fb5780455705610f22b6e2","sha256":"ccf783ef401fef307483b90412ff9210ba213da2f4972b2f342b3b54cd1b1cc5","sha512":"e7cfcd218eb3dff0b240c869c6ac165571e99626f8e8cf50754ebcdd8b50743be0160b17193e636e9d51df931f2abfee48a6227db10f1f760cbcdbbc3ab64794","ssdeep":"96:7yYYLGAgryNTrJqgI4axN1TLDBMQFZ7U6yJOmD9fEz6HzTdmGRom:wGx2PJqg4BXNMQF9U6oYzYdJb","tlshash":"d7b1af9c0c897b0fc327173e9f12ad0e1176d0a85a53a4f69104ed78fcc6480df46ad8","first_seen":"2026-10-13T13:41:39.364215Z","last_seen":"2026-10-13T15:48:40.640236Z","times_seen":3,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/login_image.webp","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebook-secure-my-account.brothersexpeditions.com/","date":"2026-10-13T15:48:11.511Z","timestamp":1791906491511,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET /login_image.webp HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebook-secure-my-account.brothersexpeditions.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: image/webp\r\ncontent-length: 181500\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 19 Oct 2026 23:41:23 GMT\r\nlast-modified: Mon, 12 Oct 2026 23:41:15 GMT\r\netag: \"2c4fc-6acd701b-431dd0559a73eb29;;;\"\r\nplatform: hostinger\r\npanel: hpanel\r\ncontent-security-policy: upgrade-insecure-requests\r\nage: 7623\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: 023f7f9da2154f8c527c120f05bdc363-bnk-edge6\r\nx-hcdn-cache-status: HIT\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]}],"data":{"size":181500,"size_decoded":182025,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5f2298aefd3399d1fe0edec6ce26fa59","sha1":"2229ffc5e19703742292b7f6a3942dfd6aabc147","sha256":"141d76714aa87822291262f9ea967f67172cb5f8744fff844edb77bf19986cbe","sha512":"f18e1be7551c569e6a64beaa230d10110937d64ad61c7a3ab004ecab868a877264520f7af0b5c202cbcc477a0470809257255880f718826f7ebd294b0ef69059","ssdeep":"3072:jrQMBmaiTTvz/IS4jRm/DrZWiDEzow9BkwDlwBxUScc/hFaXmDENSMJJ1pSufqG3:jLBma04FUcSEzoOB/cxUSbstNFZ1qHh2","tlshash":"dc042383d32b1d15a39148b6eee707905f7421865fa01b8c241e2a90ecdbd63b7578ef","first_seen":"2026-02-01T20:49:54.671942Z","last_seen":"2026-10-13T16:19:05.626743Z","times_seen":5012,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/img/meta.png","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebook-secure-my-account.brothersexpeditions.com/","date":"2026-10-13T15:48:11.513Z","timestamp":1791906491513,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET /img/meta.png HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebook-secure-my-account.brothersexpeditions.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24338\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=604800\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: 30b7e5409f7770dd3a9fd9ba8e314e75-bnk-edge6\r\nx-hcdn-cache-status: EXPIRED\r\nx-hcdn-upstream-rt: 0.141\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]}],"data":{"size":24338,"size_decoded":24740,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d2000becf053e125796adaf308449e4a","sha1":"40bd6eab21143a593e064826e5b00b7d9d1c327d","sha256":"1d2c1ce1e05c77cb9f5cb47a8c07d99be9d39081dd8cfdf335a2c97435bcff0b","sha512":"dd6013056d627668fc39a316a23bb672dc99d2ab19d34a083d4fb838f830e2b70eee4a0be741211198299ec133e5398ae7eafd01695aa93b1a1e347a1f294c51","ssdeep":"384:KY1PJwK8krzLsxvgV8MLjTp4wup0+9b6gTGNzt5U+LNB76QFJhXe9UinNUuvJWOJ:KYtJV7+o+C94wupV9+gTGNzt51NB77Fo","tlshash":"d9b2c0ca3cda69bee83075bf5c260bca7f61990235993c43924b624e8580bf5cd4d4e7","first_seen":"2026-10-13T13:41:39.366293Z","last_seen":"2026-10-13T15:48:40.641807Z","times_seen":3,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebook-secure-my-account.brothersexpeditions.com/favicon.ico","fqdn":"facebook-secure-my-account.brothersexpeditions.com","domain":"brothersexpeditions.com","tld":"com"},"ip":{"addr":"91.108.123.102","port":443,"asn":47583,"as":"Hostinger International Limited","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebook-secure-my-account.brothersexpeditions.com/","date":"2026-10-13T15:48:11.682Z","timestamp":1791906491682,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"facebook-secure-my-account.brothersexpeditions.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Oct 2026 22:41:59 GMT","end":"Sun, 10 Jan 2027 22:41:58 GMT"},"fingerprint":{"sha1":"88:86:5B:57:19:F1:EE:84:0A:68:68:F6:4D:AF:4E:7B:3C:EF:B7:5F","sha256":"52:EE:D1:11:01:5E:19:D1:48:EE:79:B2:A4:87:F7:84:94:0F:B9:02:1E:19:49:09:93:0E:3D:28:DE:55:13:B5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: facebook-secure-my-account.brothersexpeditions.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebook-secure-my-account.brothersexpeditions.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ndate: Tue, 13 Oct 2026 15:48:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 1626\r\nlast-modified: Thu, 05 Jun 2025 10:08:38 GMT\r\netag: \"119f-68416ca6-4ef62a4b47385167;br\"\r\ncontent-encoding: br\r\nplatform: hostinger\r\npanel: hpanel\r\nserver: hcdn\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-hcdn-request-id: f6b397af9cbc4d2dc7bd1d1a0fe7fb96-bnk-edge6\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Hostinger CDN","description":"Hostinger Content Delivery Network (CDN).","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["CDN"]},{"name":"Hostinger","description":"Hostinger is an employee-owned Web hosting provider and internet domain registrar.","website":"https://www.hostinger.com","common_platform_enumeration":"","icon":"Hostinger.svg","categories":["Hosting"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}],"data":{"size":4511,"size_decoded":1979,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (371)","md5":"b16e9097fc7d3af8ebfcfce7aba0a42d","sha1":"2af3c8408b8445fe81d9a7c8d7cc8e8a05bf80f5","sha256":"e7db95c97a5d45787cc3e40cbcb93b748fefc65bc14e162c746e37f979861729","sha512":"53a7a2c276fbc5159231c162eb863504448515f1a078832b81f1bffeedb1c82932810b66748fd4111d1b8fb866622a5cc63e79e497227b611c90886ba45d3f3b","ssdeep":"96:tr+ulojsBwJG8YqVcqHL/GSrrLc1VhrJuzeK:tyoasBwJG8nVjaSeVhrJgeK","tlshash":"0891f88f25f381452603c99037f9b61499554007f685eca8bdee9228cfc4b8a41e3bdc","first_seen":"2025-04-22T08:45:29.599713Z","last_seen":"2026-10-13T17:45:36.240218Z","times_seen":42374,"resource_available":true,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-13","alert":"Phishing Block","trigger":"facebook-secure-my-account.brothersexpeditions.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}}]}