{"report_id":"527c4cb8-b30e-4b8f-99d1-f72cbeb9e617","version":0,"status":"done","tags":[],"date":"2026-09-15T14:09:27Z","url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":0,"asn":206208,"as":"Pusic Jurai","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"title":"HK$ 380.00 | 你的商品 買家已經成功付款 請點擊確認訂單 進行收款","dom":{"size":70534,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2756)","md5":"6bde9e185e339892515064c1ae0ca5be","sha1":"8be6eef0756a3da194f94ecceb85bef3b894f594","sha256":"f36ba3569196ee4cd76d309ca2e5acad9ca5a0450b340e07fbcfd74b9e5e9b09","sha512":"abdd23c1927058064b410ea25a390dc8625fe6606bd41269647e7cbaa14256e4f0c3576aee8828b02c319a57562672064e0777cc2d52a864881a8a9ca0ac87c8","ssdeep":"768:Hnv0AU5I1D8BWpyrMikW1e+yxbCY0nAi20ozyMjGAx+gI3cZK0bhaowrHw0XmS+Q:b60/iD+cuHValwWn+QFWLYHjcw59xgG","tlshash":"0c634ba7f7ea081670674378a7aa7285322e4463814bc534bded321c5fce9c49976f8c","dom_hash":"domhash658f0c5b1c9a9daccc3f24ebb6fde9e0","first_seen":"2026-09-15T14:09:33.155913Z","last_seen":"2026-09-15T14:09:33.155913Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":0,"asn":206208,"as":"Pusic Jurai","country":"Iran","country_code":"IR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-20T14:09:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"marketplace.facebook-pay.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"metapay.facebook-secure.shop","ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-15T14:07:45.882799Z","last_seen":"2026-09-15T14:07:45.882799Z","alert_count":42,"request_count":14,"received_data":291315,"sent_data":7031,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"marketplace.facebook-pay.click","ip":{"addr":"172.67.197.27","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-15T14:09:28.274857Z","last_seen":"2026-09-15T14:09:28.274857Z","alert_count":2,"request_count":2,"received_data":2947,"sent_data":892,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"d360fa52d872518979e15fb0a1e1aa57","sha1":"fc22ecf303e1ec685f7a0b127f4a4b5b6779afd7","sha256":"04a8f38670cfd4076b0ba8ceaebc6fe82f92c1127737756294c9d8b0ff11b346","sha512":"2ad324cf5abb3adc25735c3abf6ac50da2de0f4486445e6fee33c0987037d4ff38291dd0ec971a95a0f43e073452e8683db1243521713ed29062fd48ea3a0328","ssdeep":"","tlshash":"e5c08cc8b3427b86d6b52130462fa108305620170987a928638290e0be9bc67f45be9f","size":161,"data":"","first_seen":"2026-09-15T14:09:33.174258Z","last_seen":"2026-09-15T14:09:33.174258Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"6f1936378e072c3dbadb6dddd4ab5b4f","sha1":"b31b055a83d04fbae9f8a6ab0bc2bea52e7f8eed","sha256":"6b4d3821d6f963b043778b587198150f5819cc29b082f8785bce9ee4cbb11c56","sha512":"81e4c83c6c47a4a529e8ba8414419ed1c2bf04ae84a09dd186cbe964cb26406b9b7bb9a43447a9bd602a5f9b1fee2e15ab152bc5992286ab9f8eef6a332890f1","ssdeep":"","tlshash":"50800083a8b03c0c028800a2320a33c820320ab8be820af0802e0000288f2a20acc380","size":32,"data":"","first_seen":"2026-09-15T14:09:33.176717Z","last_seen":"2026-09-15T14:09:33.176717Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"c5c144ee30f72c0df1d956208fb50e9a","sha1":"0cbcd20a1da635eaea66adef693de4338bb0b0db","sha256":"25dee400afb0294c4d26b2ad6470c98f4a01c8e606c371f4aba0c6fecc5ce3b1","sha512":"eece5f3533ecec317e6ec708300fc64c0fb0c2f126ab6dbcd63be6b7dc4abef387ad285ee1c9a3b21ece814c9366029df515a5a94a077796fef3ba645fbb1ebf","ssdeep":"","tlshash":"4a21753b8bbc0c5771b818f8eb8b171689e357c11fe105ad5c0da8a4221e2a3dd87e81","size":1365,"data":"","first_seen":"2026-09-15T14:09:33.17899Z","last_seen":"2026-09-15T14:09:33.17899Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"581040045677a7053a52f29220453ec3","sha1":"2e997639853c90bd9b3c6ed0bc4a4cb11d0f8ce5","sha256":"01531d444da171d18830c799d7ac5fd36ac5851e834d1e7f1349ab778a1f44cc","sha512":"6b12a7fc7563acbce575f4a3fd2ef3de09205537350b1524a15eb30e76ebd5975bf0e9e11d72cb3fea3381af864082e3283d101cb249682ed11ae1a0321a8713","ssdeep":"","tlshash":"095111a7fbed047399772c27808a77cc786da0e41d81a9224c9cd51620e0d5d8b7bde8","size":2947,"data":"","first_seen":"2026-09-15T14:09:33.181033Z","last_seen":"2026-09-15T14:09:33.181033Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"526472d13360463650bb7d6e21c9c3c0","sha1":"2f7ecb50d88ce2bc7d7190188e623c17dc07d23d","sha256":"5ef368d27b52e63b730bccfd917d4f3e0367c96abb27c5a2ad24c37fe6b2f03c","sha512":"f7c99a05a92068c90099cea8fc6e0eb581b762000aec11d3cf0dbd50e87cc5bbf93b3d162452ddb894be801fb16b2ed2fee5496405579ebcf5f13c0093d3fdbd","ssdeep":"384:JNrHw0XmS+5S5/WL4DvHjc1G59xCFUbBM:/rHw0XmS+5S5/WLYHjcw59xgU+","tlshash":"b072426ab9f3207a55bb303e5bef2008b5358053044bcd31bd5c9a486f90ae157bafd8","size":16738,"data":"","first_seen":"2026-09-15T14:09:33.183002Z","last_seen":"2026-09-15T14:09:33.183002Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/axios.min.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"f474b10dd6aa8be5ab5184c36f9a865a","sha1":"9b26ba505baeef03167c1205cd9dbec35ad1f9a6","sha256":"bd2851255efd58fc6ebe80cef87696d3f6138c270b69ad21abae2e6b3883adff","sha512":"00d77b6499a2c4fd93d21c4e3f86d2ea191c8b4d5fc72ad04b245d698ec8b16ab55a52ac0f45b05810d50d96e7311ec225954a093903c7fab90f99f60b60bebe","ssdeep":"768:JCEC6jLwVKlrVa6wPQuQM70pLWulmhBD5xv:BhaDvn0Zlit","tlshash":"0ce2e7c9b7e1b06153a770b5407f250bf23aa926a44d84a0f120ece67cb850e9767f7d","size":33655,"data":"","first_seen":"2024-01-04T11:59:43Z","last_seen":"2026-09-15T14:09:33.169129Z","times_seen":260,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/console-ban.min.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"65bcc95f5c595112f6b5f05705aa76c1","sha1":"ac16dfd7043a4dbec0fc648b5397420b9f3bd836","sha256":"c3172f40c0b891c351a8844aa979038ea8c00e3f755cb7521617095e2758c165","sha512":"712e7c511881a3fa3941750c0664fb52d1155feb9c3b0f3c8769a549f95b350a67c959aede3deec75d15240b275f6b6e04a93d7954def0709ef4d0b4c40ed56c","ssdeep":"","tlshash":"78415399b5c171a023b3a4a5883f950b7237897f994c55aef051e6ec1ebc84e0743f3a","size":2254,"data":"","first_seen":"2023-03-07T01:25:42Z","last_seen":"2026-09-15T14:09:33.16549Z","times_seen":458,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-09-15T17:43:51.662406Z","times_seen":239467,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/index.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"8653b933c4414059d28677422f645159","sha1":"cfeb81a711f0975c264b80bf3d39e094f3de2851","sha256":"37e6d24fdc8f4d6fb85a092aa85e9e28a40a187f36ed8dbb747d968fd277ed29","sha512":"fb54ba5815db09c4c6129494ba8794d51e6e7a5b27641c27c348fd9e244be0aa83b9129872dc247038409546c2fbe823ee143efb372bc99eec11a941b2834a90","ssdeep":"","tlshash":"53219b61f51a21bfa7d637546272da8b7cb4d4b1304b90bcf064195c30a2827d19bd89","size":1136,"data":"","first_seen":"2024-12-16T12:34:16.693234Z","last_seen":"2026-09-15T14:09:33.170725Z","times_seen":201,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/main.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"d0f8942409532dd21da243abf2bed6c6","sha1":"5f571daa959eaac63811f0b7be5d8c4a9fbd0aae","sha256":"007285d22242c770dd0b3e97dbd1bbeb98c562579ed8c4609e0a5c1e6b905b70","sha512":"f168b29bd366dc10c625b50c5e8c4857079ed48a26ff781b6d9321468bceda059d2c2f5187651ae9bfc28308159929daa3d1e6eeb857eff133bbd3a7ac9cd433","ssdeep":"1536:orHz2xnpl1GAsF/2e37mG9FiWT4Oi0gb3QLcdoNHUn8zOFaN6uE7INTlp:x69FhT4GgbgfS8zOcN6X7O","tlshash":"6f93738277d17d83234797773727a1e4e56aac99a1c444c9f208bc94f0eda13fad4ab0","size":97116,"data":"","first_seen":"2025-06-27T04:23:23.072683Z","last_seen":"2026-09-15T14:09:33.164135Z","times_seen":131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-09-15T18:48:38.090382Z","times_seen":756375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/chat_api.php","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:23.284Z","timestamp":1789481363284,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /chat_api.php HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nContent-Type: multipart/form-data; boundary=----geckoformboundary5e796ee49a554c74af531e78291ff8f7\r\nContent-Length: 283\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: fb_lang=en\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":283,"data":"------geckoformboundary5e796ee49a554c74af531e78291ff8f7\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\npoll\r\n------geckoformboundary5e796ee49a554c74af531e78291ff8f7\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n09066807\r\n------geckoformboundary5e796ee49a554c74af531e78291ff8f7--\r\n"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: fb_lang=en; expires=Wed, 15-Sep-2027 14:09:23 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"fb_lang","value":"en","quoted":false,"path":"/","expires":"2027-09-15T14:09:23Z","raw_expires":"Wed, 15-Sep-2027 14:09:23 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"fb_lang=en; expires=Wed, 15-Sep-2027 14:09:23 GMT; Max-Age=31536000; path=/; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":925,"size_decoded":870,"mime_type":"application/json","magic":"JSON text data","md5":"7ed722c5d43cd01a43aa7fc5db2c49db","sha1":"7c829ea2dca323a1eb1c35618a302406b26f4943","sha256":"a4d2a6427880210181ea930239c34a3857d3985d2e26dc67dbf4aeaa65e0d9b8","sha512":"80ea153d781049d55071793ca54da255435dc0f117fd97353ab7957f44391955ef55ce0a9681d906fbaec7d7c308a6adf3909303e6af03eb4858d958ff6df11e","ssdeep":"","tlshash":"1711040ba2046fb75e860725b85e3fdd6be6146d0390a0158c7f0e58469222fd323ce3","first_seen":"2026-09-15T14:09:33.158164Z","last_seen":"2026-09-15T14:09:33.158164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":571,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":571,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-15T14:08:58.473Z","timestamp":1789481338473,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /order/09066807 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-15T18:51:37.24551Z","times_seen":18480505,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/order/09066807","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-15T14:08:58.623Z","timestamp":1789481338623,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /order/09066807 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:58 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 17129\r\nConnection: keep-alive\r\nSet-Cookie: fb_lang=en; expires=Wed, 15-Sep-2027 14:08:58 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"fb_lang","value":"en","quoted":false,"path":"/","expires":"2027-09-15T14:08:58Z","raw_expires":"Wed, 15-Sep-2027 14:08:58 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"fb_lang=en; expires=Wed, 15-Sep-2027 14:08:58 GMT; Max-Age=31536000; path=/; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69355,"size_decoded":17437,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2750)","md5":"0b34ee67a70d5fa491897f8a6d045098","sha1":"c567cbf03057f66424f4cdb65fddad510fd1681d","sha256":"dfce84a268029e511e445d8df65a291d4932c587bb57433b7a7a3dc26d6d09ab","sha512":"4895ea09b76a60abec1b6ae5a5d52b5d7a8a096db5cd6f5b450f40aead49a060b87bfc0523b14beeef08d028b978cd7d573a7e183b06c277f37ca587fb6b90b0","ssdeep":"768:2nv0AU5I1D8BWpyrMikW1e+yxbCY0nAi20ozyMd1UxDgROItK0ihxR5rHw0XmS+Q:S60/iD+cvyWxLwWn+QFWLYHjcw59xge","tlshash":"7d634bb7f7ea0806b0674278a7aa7245322e4463814bc934bddd321c5fcd9c49976f8c","first_seen":"2026-09-15T14:09:33.160081Z","last_seen":"2026-09-15T14:09:33.160081Z","times_seen":1,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":5,"connect":41,"send":0,"wait":306,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.facebook-pay.click/favicon.svg","fqdn":"marketplace.facebook-pay.click","domain":"facebook-pay.click","tld":"click"},"ip":{"addr":"172.67.197.27","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.713Z","timestamp":1789481339713,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: marketplace.facebook-pay.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Fri, 19 Jun 2026 14:10:19 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: W/\"6a354dcb-2ba\"\r\nExpires: Wed, 16 Sep 2026 14:08:59 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kBsOtA3mE2lTOuNV8GxwAYSq9bNWaT4dOO%2FcmdGK7XHSMiV3i4Tu8L7uuFDErvvXfUMZ8d5Wc4D1jrDzTn7Dfbff4hlD9g5fT142N54DJaW2KrA2%2FSbTJ1hS%2FKRp%2Fae3bDVIFxnhx8aoqInQi5q7VZ0%3D\"}]}\r\nCF-RAY: a3b834e56e2cc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":698,"size_decoded":1185,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2802b7d3d0dacb1a2ebff61116f6711","sha1":"46cb85bce3f4bd90fd1dd3ced35b71e47b671714","sha256":"edf903f4224cfbcabdc788473d6e67a0501c725d8724400c2d9900884e31c672","sha512":"7133cb01fba464957983aded0ae59b625ec738c7bdd59f44928cfeb0e2dcb4525ae81a9158c3bcedae367169dd625ba63cf99dfe0b5df9b6a93eebf9c67ec289","ssdeep":"","tlshash":"3c01c0966e47428cd0105b5897d0b8a165e968b27d42007bce943d4bb1db90ccf8dd46","first_seen":"2026-09-15T14:09:33.16135Z","last_seen":"2026-09-15T14:09:33.16135Z","times_seen":1,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":26,"connect":2,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"marketplace.facebook-pay.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/api/core/update","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:07.292Z","timestamp":1789481347292,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /api/core/update HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/json\r\nContent-Length: 117\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":117,"data":"{\"id\":\"09066807\",\"pageTitle\":\"HK$ 380.00 | 你的商品 買家已經成功付款 請點擊確認訂單 進行收款\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:07 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124,"size_decoded":440,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"c8b7e98800e20386073d266558ce19d9","sha1":"c375a093bc8e97d75d539c2ee9332529a7749834","sha256":"3797882d1a99472beebc7cbf9dba446144e68fffa0249add5d6ea9b708bc32b3","sha512":"2001719fc42837cf34fc89b97fbd821fe6c44fab4f907190d19a81bb04920b14b6483bf1203d3fd61a6c7a36d8cf89d63ff00500408a28b8bfa47d3ee5f1f657","ssdeep":"","tlshash":"0cb09bd554168d3ddd40c3549381f31ddbca4111f1d0525dc1bc0c5163dd49c7515d21","first_seen":"2026-09-15T14:09:33.162552Z","last_seen":"2026-09-15T14:09:33.162552Z","times_seen":1,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/api/core/update","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:15.288Z","timestamp":1789481355288,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /api/core/update HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/json\r\nContent-Length: 117\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":117,"data":"{\"id\":\"09066807\",\"pageTitle\":\"HK$ 380.00 | 你的商品 買家已經成功付款 請點擊確認訂單 進行收款\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:15 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124,"size_decoded":440,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"c8b7e98800e20386073d266558ce19d9","sha1":"c375a093bc8e97d75d539c2ee9332529a7749834","sha256":"3797882d1a99472beebc7cbf9dba446144e68fffa0249add5d6ea9b708bc32b3","sha512":"2001719fc42837cf34fc89b97fbd821fe6c44fab4f907190d19a81bb04920b14b6483bf1203d3fd61a6c7a36d8cf89d63ff00500408a28b8bfa47d3ee5f1f657","ssdeep":"","tlshash":"0cb09bd554168d3ddd40c3549381f31ddbca4111f1d0525dc1bc0c5163dd49c7515d21","first_seen":"2026-09-15T14:09:33.162552Z","last_seen":"2026-09-15T14:09:33.162552Z","times_seen":1,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/main.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.051Z","timestamp":1789481339051,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /index_files/main.js?v=1781180877 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 35296\r\nConnection: keep-alive\r\nLast-Modified: Thu, 11 Jun 2026 12:27:57 GMT\r\nETag: \"17b5c-653f97d744d40-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97116,"size_decoded":35594,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d0f8942409532dd21da243abf2bed6c6","sha1":"5f571daa959eaac63811f0b7be5d8c4a9fbd0aae","sha256":"007285d22242c770dd0b3e97dbd1bbeb98c562579ed8c4609e0a5c1e6b905b70","sha512":"f168b29bd366dc10c625b50c5e8c4857079ed48a26ff781b6d9321468bceda059d2c2f5187651ae9bfc28308159929daa3d1e6eeb857eff133bbd3a7ac9cd433","ssdeep":"1536:orHz2xnpl1GAsF/2e37mG9FiWT4Oi0gb3QLcdoNHUn8zOFaN6uE7INTlp:x69FhT4GgbgfS8zOcN6X7O","tlshash":"6f93738277d17d83234797773727a1e4e56aac99a1c444c9f208bc94f0eda13fad4ab0","first_seen":"2025-06-27T04:23:23.072683Z","last_seen":"2026-09-15T14:09:33.164135Z","times_seen":131,"resource_available":true,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":39,"send":0,"wait":86,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/chat_api.php","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.283Z","timestamp":1789481339283,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /chat_api.php HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nContent-Type: multipart/form-data; boundary=----geckoformboundarycfafd2c4b031370fe8eb84f832c8dcd1\r\nContent-Length: 283\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: fb_lang=en\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":283,"data":"------geckoformboundarycfafd2c4b031370fe8eb84f832c8dcd1\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\npoll\r\n------geckoformboundarycfafd2c4b031370fe8eb84f832c8dcd1\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n09066807\r\n------geckoformboundarycfafd2c4b031370fe8eb84f832c8dcd1--\r\n"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: fb_lang=en; expires=Wed, 15-Sep-2027 14:08:59 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"fb_lang","value":"en","quoted":false,"path":"/","expires":"2027-09-15T14:08:59Z","raw_expires":"Wed, 15-Sep-2027 14:08:59 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"fb_lang=en; expires=Wed, 15-Sep-2027 14:08:59 GMT; Max-Age=31536000; path=/; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":925,"size_decoded":870,"mime_type":"application/json","magic":"JSON text data","md5":"7ed722c5d43cd01a43aa7fc5db2c49db","sha1":"7c829ea2dca323a1eb1c35618a302406b26f4943","sha256":"a4d2a6427880210181ea930239c34a3857d3985d2e26dc67dbf4aeaa65e0d9b8","sha512":"80ea153d781049d55071793ca54da255435dc0f117fd97353ab7957f44391955ef55ce0a9681d906fbaec7d7c308a6adf3909303e6af03eb4858d958ff6df11e","ssdeep":"","tlshash":"1711040ba2046fb75e860725b85e3fdd6be6146d0390a0158c7f0e58469222fd323ce3","first_seen":"2026-09-15T14:09:33.158164Z","last_seen":"2026-09-15T14:09:33.158164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":544,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/chat_api.php","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:07.286Z","timestamp":1789481347286,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /chat_api.php HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nContent-Type: multipart/form-data; boundary=----geckoformboundary2e2ff50b24e65f72a72022d143a1723f\r\nContent-Length: 283\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: fb_lang=en\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":283,"data":"------geckoformboundary2e2ff50b24e65f72a72022d143a1723f\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\npoll\r\n------geckoformboundary2e2ff50b24e65f72a72022d143a1723f\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n09066807\r\n------geckoformboundary2e2ff50b24e65f72a72022d143a1723f--\r\n"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: fb_lang=en; expires=Wed, 15-Sep-2027 14:09:07 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"fb_lang","value":"en","quoted":false,"path":"/","expires":"2027-09-15T14:09:07Z","raw_expires":"Wed, 15-Sep-2027 14:09:07 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"fb_lang=en; expires=Wed, 15-Sep-2027 14:09:07 GMT; Max-Age=31536000; path=/; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":925,"size_decoded":870,"mime_type":"application/json","magic":"JSON text data","md5":"7ed722c5d43cd01a43aa7fc5db2c49db","sha1":"7c829ea2dca323a1eb1c35618a302406b26f4943","sha256":"a4d2a6427880210181ea930239c34a3857d3985d2e26dc67dbf4aeaa65e0d9b8","sha512":"80ea153d781049d55071793ca54da255435dc0f117fd97353ab7957f44391955ef55ce0a9681d906fbaec7d7c308a6adf3909303e6af03eb4858d958ff6df11e","ssdeep":"","tlshash":"1711040ba2046fb75e860725b85e3fdd6be6146d0390a0158c7f0e58469222fd323ce3","first_seen":"2026-09-15T14:09:33.158164Z","last_seen":"2026-09-15T14:09:33.158164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":541,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":541,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/console-ban.min.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.049Z","timestamp":1789481339049,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /index_files/console-ban.min.js?v=1781180877 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 1037\r\nConnection: keep-alive\r\nLast-Modified: Thu, 11 Jun 2026 12:27:57 GMT\r\nETag: \"8ce-653f97d744d40-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2254,"size_decoded":1332,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2166)","md5":"65bcc95f5c595112f6b5f05705aa76c1","sha1":"ac16dfd7043a4dbec0fc648b5397420b9f3bd836","sha256":"c3172f40c0b891c351a8844aa979038ea8c00e3f755cb7521617095e2758c165","sha512":"712e7c511881a3fa3941750c0664fb52d1155feb9c3b0f3c8769a549f95b350a67c959aede3deec75d15240b275f6b6e04a93d7954def0709ef4d0b4c40ed56c","ssdeep":"","tlshash":"78415399b5c171a023b3a4a5883f950b7237897f994c55aef051e6ec1ebc84e0743f3a","first_seen":"2023-03-07T01:25:42Z","last_seen":"2026-09-15T14:09:33.16549Z","times_seen":458,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":36,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/uploads/products/09066807.jpg","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.286Z","timestamp":1789481339286,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/products/09066807.jpg HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 79513\r\nLast-Modified: Fri, 11 Sep 2026 10:55:37 GMT\r\nConnection: keep-alive\r\nETag: \"6aa3de29-13699\"\r\nExpires: Wed, 16 Sep 2026 14:08:59 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79513,"size_decoded":79819,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 600x800, components 3","md5":"f086b79be69c0a33c5583d913ed8a3cd","sha1":"60c8310cbdb6d056f150007690fb1f3809a5b620","sha256":"69fb1d467c83d563a6b8f99628203ed4c3bfb6f644b4c9278204ec7aad33c158","sha512":"6372ef36054224004183e1e6658e4265915adc08ce1b930483b6d3af709f80a73fa41c58d5fdcb2b9111969bde2e231e9059fc08747edd1461fd3b55b06a6bac","ssdeep":"1536:5MhgDsmwtLlRSvc5SrCYeKmEYc6J5oZnaW6jV+MeM3Agk4MEEJNHD+xTD9:ChgDiKvtrJeK6RJUnaW6j0TXNj+xTZ","tlshash":"1c7302fd461124c648e1fe2047b05f9ee3927eb661c8542a9074a7838d23cf627e7d99","first_seen":"2026-09-15T14:09:33.165986Z","last_seen":"2026-09-15T14:09:33.165986Z","times_seen":1,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/api/core/update","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:23.288Z","timestamp":1789481363288,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /api/core/update HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/json\r\nContent-Length: 117\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":117,"data":"{\"id\":\"09066807\",\"pageTitle\":\"HK$ 380.00 | 你的商品 買家已經成功付款 請點擊確認訂單 進行收款\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:23 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124,"size_decoded":440,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"c8b7e98800e20386073d266558ce19d9","sha1":"c375a093bc8e97d75d539c2ee9332529a7749834","sha256":"3797882d1a99472beebc7cbf9dba446144e68fffa0249add5d6ea9b708bc32b3","sha512":"2001719fc42837cf34fc89b97fbd821fe6c44fab4f907190d19a81bb04920b14b6483bf1203d3fd61a6c7a36d8cf89d63ff00500408a28b8bfa47d3ee5f1f657","ssdeep":"","tlshash":"0cb09bd554168d3ddd40c3549381f31ddbca4111f1d0525dc1bc0c5163dd49c7515d21","first_seen":"2026-09-15T14:09:33.162552Z","last_seen":"2026-09-15T14:09:33.162552Z","times_seen":1,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":90,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/axios.min.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.048Z","timestamp":1789481339048,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /index_files/axios.min.js?v=1781180877 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 12446\r\nConnection: keep-alive\r\nLast-Modified: Thu, 11 Jun 2026 12:27:57 GMT\r\nETag: \"8377-653f97d744d40-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33655,"size_decoded":12743,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (33616)","md5":"f474b10dd6aa8be5ab5184c36f9a865a","sha1":"9b26ba505baeef03167c1205cd9dbec35ad1f9a6","sha256":"bd2851255efd58fc6ebe80cef87696d3f6138c270b69ad21abae2e6b3883adff","sha512":"00d77b6499a2c4fd93d21c4e3f86d2ea191c8b4d5fc72ad04b245d698ec8b16ab55a52ac0f45b05810d50d96e7311ec225954a093903c7fab90f99f60b60bebe","ssdeep":"768:JCEC6jLwVKlrVa6wPQuQM70pLWulmhBD5xv:BhaDvn0Zlit","tlshash":"0ce2e7c9b7e1b06153a770b5407f250bf23aa926a44d84a0f120ece67cb850e9767f7d","first_seen":"2024-01-04T11:59:43Z","last_seen":"2026-09-15T14:09:33.169129Z","times_seen":260,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/index_files/index.js?v=1781180877","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.052Z","timestamp":1789481339052,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /index_files/index.js?v=1781180877 HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nCookie: fb_lang=en\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 502\r\nConnection: keep-alive\r\nLast-Modified: Thu, 11 Jun 2026 12:27:57 GMT\r\nETag: \"470-653f97d744d40-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1136,"size_decoded":796,"mime_type":"text/javascript","magic":"ASCII text, with CRLF line terminators","md5":"8653b933c4414059d28677422f645159","sha1":"cfeb81a711f0975c264b80bf3d39e094f3de2851","sha256":"37e6d24fdc8f4d6fb85a092aa85e9e28a40a187f36ed8dbb747d968fd277ed29","sha512":"fb54ba5815db09c4c6129494ba8794d51e6e7a5b27641c27c348fd9e244be0aa83b9129872dc247038409546c2fbe823ee143efb372bc99eec11a941b2834a90","ssdeep":"","tlshash":"53219b61f51a21bfa7d637546272da8b7cb4d4b1304b90bcf064195c30a2827d19bd89","first_seen":"2024-12-16T12:34:16.693234Z","last_seen":"2026-09-15T14:09:33.170725Z","times_seen":201,"resource_available":true,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":39,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.facebook-pay.click/favicon.svg","fqdn":"marketplace.facebook-pay.click","domain":"facebook-pay.click","tld":"click"},"ip":{"addr":"172.67.197.27","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:08:59.711Z","timestamp":1789481339711,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: marketplace.facebook-pay.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://metapay.facebook-secure.shop/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 15 Sep 2026 14:08:59 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nLast-Modified: Fri, 19 Jun 2026 14:10:19 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: W/\"6a354dcb-2ba\"\r\nExpires: Wed, 16 Sep 2026 14:08:59 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\nAge: 0\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V8Ndah1WOM9VmfYzIEhck2jIQMWXulq7OixGatmo538yHjxeXHa4az9i1ODgWOtporREuCxPWC2i85ISkoqMmntWuyEkeWKjmJnh1iCXRgwgj%2Fo%2BmLolfDlCi05aaPp59z24YhQwtl%2Fwo765%2FD99vEI%3D\"}]}\r\nCF-RAY: a3b834e56816b500-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":698,"size_decoded":1192,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2802b7d3d0dacb1a2ebff61116f6711","sha1":"46cb85bce3f4bd90fd1dd3ced35b71e47b671714","sha256":"edf903f4224cfbcabdc788473d6e67a0501c725d8724400c2d9900884e31c672","sha512":"7133cb01fba464957983aded0ae59b625ec738c7bdd59f44928cfeb0e2dcb4525ae81a9158c3bcedae367169dd625ba63cf99dfe0b5df9b6a93eebf9c67ec289","ssdeep":"","tlshash":"3c01c0966e47428cd0105b5897d0b8a165e968b27d42007bce943d4bb1db90ccf8dd46","first_seen":"2026-09-15T14:09:33.16135Z","last_seen":"2026-09-15T14:09:33.16135Z","times_seen":1,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":27,"connect":2,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"marketplace.facebook-pay.click","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"metapay.facebook-secure.shop/chat_api.php","fqdn":"metapay.facebook-secure.shop","domain":"facebook-secure.shop","tld":"shop"},"ip":{"addr":"62.60.227.68","port":80,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://metapay.facebook-secure.shop/order/09066807","date":"2026-09-15T14:09:15.285Z","timestamp":1789481355285,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"POST /chat_api.php HTTP/1.1\r\nHost: metapay.facebook-secure.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://metapay.facebook-secure.shop/order/09066807\r\nContent-Type: multipart/form-data; boundary=----geckoformboundarydb9c5b510aff61d67784a3e806f13b5\r\nContent-Length: 280\r\nOrigin: http://metapay.facebook-secure.shop\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: fb_lang=en\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":280,"data":"------geckoformboundarydb9c5b510aff61d67784a3e806f13b5\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\npoll\r\n------geckoformboundarydb9c5b510aff61d67784a3e806f13b5\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n09066807\r\n------geckoformboundarydb9c5b510aff61d67784a3e806f13b5--\r\n"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 15 Sep 2026 14:09:15 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: fb_lang=en; expires=Wed, 15-Sep-2027 14:09:15 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"fb_lang","value":"en","quoted":false,"path":"/","expires":"2027-09-15T14:09:15Z","raw_expires":"Wed, 15-Sep-2027 14:09:15 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"fb_lang=en; expires=Wed, 15-Sep-2027 14:09:15 GMT; Max-Age=31536000; path=/; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":925,"size_decoded":870,"mime_type":"application/json","magic":"JSON text data","md5":"7ed722c5d43cd01a43aa7fc5db2c49db","sha1":"7c829ea2dca323a1eb1c35618a302406b26f4943","sha256":"a4d2a6427880210181ea930239c34a3857d3985d2e26dc67dbf4aeaa65e0d9b8","sha512":"80ea153d781049d55071793ca54da255435dc0f117fd97353ab7957f44391955ef55ce0a9681d906fbaec7d7c308a6adf3909303e6af03eb4858d958ff6df11e","ssdeep":"","tlshash":"1711040ba2046fb75e860725b85e3fdd6be6146d0390a0158c7f0e58469222fd323ce3","first_seen":"2026-09-15T14:09:33.158164Z","last_seen":"2026-09-15T14:09:33.158164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":560,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":560,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"metapay.facebook-secure.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"metapay.facebook-secure.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}