{"report_id":"656f25e8-f0b9-43f8-8aad-60bcbf797327","version":0,"status":"done","tags":["meta","facebook","phishing","social"],"date":"2026-10-06T22:09:52Z","url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":0,"asn":396073,"as":"Majestic Hosting Solutions, LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"title":"Facebook","dom":{"size":1087,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"0283c36b7bf14ac35d83ad5870fd22bb","sha1":"f8d63f70581523e55d20119012e93428a39126cc","sha256":"8be1766a01b98cbbeb126a9c394c7c8a3671c924ad2ba92e9af009a1ba0756c1","sha512":"f1706faf8bc6ce84aefa7664bfd3e211e83606bd15d40ba6b9c94b16684e654868da4c9b07751c5afb222263f7e9f77fe67e51508d4adcdb3088bdded1d29b19","ssdeep":"","tlshash":"2411cb0022d02f7eb91151b8ca597e681ee684e3c3822480749f68bfbf98d11a1733bd","dom_hash":"domhash895c9a68df3c00df5aa6c35400d72c3c","first_seen":"2026-10-06T00:57:25.285971Z","last_seen":"2026-10-07T03:27:11.068972Z","times_seen":7,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":0,"asn":396073,"as":"Majestic Hosting Solutions, LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-10T22:09:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"summary":[{"fqdn":"facebookbonus.emmanueldegreatltd.com","ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"domain_registered":"2019-06-13","domain_rank":0,"first_seen":"2026-09-11T20:39:59.469343Z","last_seen":"2026-10-06T21:23:01.808225Z","alert_count":25,"request_count":5,"received_data":642881,"sent_data":2663,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.4.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-06T22:09:22.359Z","timestamp":1791324562359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.facebookbonus.emmanueldegreatltd.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 12:51:43 GMT","end":"Sun, 06 Dec 2026 12:51:42 GMT"},"fingerprint":{"sha1":"6D:81:5D:19:86:1D:AB:D8:F2:EF:F6:E3:11:84:B9:57:89:96:EF:67","sha256":"05:BE:2D:DA:12:73:5D:8B:D3:66:FD:E7:CC:E4:1D:1C:81:A4:7D:15:03:B2:6C:A9:41:31:DE:DB:44:BC:72:BC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: facebookbonus.emmanueldegreatltd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.4.26\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 469\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Oct 2026 22:09:23 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1163,"size_decoded":750,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"eda4092533fb0f9b9eb65c866391ad69","sha1":"69fae8d588265167c3f81937d03beae6cbe7cb61","sha256":"c0ff228cc8bd2cb318ec69fd73b50ff07be14aa2ac82a16c026d7d4b81c555da","sha512":"1d405055a283f4b27c5c307d0aecb07ae23c6d994f42c327a97361213957108f8353250a321b6eed1628e875c336b4cd38d5adb52aebc65327ccfbb1677c3931","ssdeep":"","tlshash":"a22126a232f1e72929336127d2716d14edf6883763061c50744f857f7be09128be36a1","first_seen":"2026-10-06T00:57:25.299346Z","last_seen":"2026-10-07T03:27:11.070895Z","times_seen":7,"resource_available":true,"data":null}},"time_used":777,"timings":{"blocked":-1,"dns":278,"connect":120,"send":0,"wait":129,"receive":0,"ssl":250},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/css/style.css","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://facebookbonus.emmanueldegreatltd.com/","date":"2026-10-06T22:09:23.358Z","timestamp":1791324563358,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.facebookbonus.emmanueldegreatltd.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 12:51:43 GMT","end":"Sun, 06 Dec 2026 12:51:42 GMT"},"fingerprint":{"sha1":"6D:81:5D:19:86:1D:AB:D8:F2:EF:F6:E3:11:84:B9:57:89:96:EF:67","sha256":"05:BE:2D:DA:12:73:5D:8B:D3:66:FD:E7:CC:E4:1D:1C:81:A4:7D:15:03:B2:6C:A9:41:31:DE:DB:44:BC:72:BC"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: facebookbonus.emmanueldegreatltd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebookbonus.emmanueldegreatltd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Oct 2026 22:09:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 06 Jul 2026 16:52:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 240\r\ndate: Tue, 06 Oct 2026 22:09:23 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":975,"size_decoded":606,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"06d861e896f172021a5c3e4cdb933705","sha1":"70622cbf91dc477e95642440f8c6135c1aabc27a","sha256":"7b03026475209635a6bfac40dde080bbbb5a15d9855c010165be9dbfc1a7872c","sha512":"fb13708068ee4015ceda0ddffe4cc5c0e5841c71da8c3ad52c3557859c0e9395c6850a632ca41d5cda57943b701cf1b4bd5ce29ff082ec404ef2c9637800ee4d","ssdeep":"","tlshash":"bb11c8a5ec058204e27389646342999e769e14475307c2afffb4b164f048b5d97707cc","first_seen":"2026-10-06T00:57:25.302164Z","last_seen":"2026-10-07T03:27:11.071734Z","times_seen":7,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/image/profile.png","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebookbonus.emmanueldegreatltd.com/","date":"2026-10-06T22:09:23.370Z","timestamp":1791324563370,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.facebookbonus.emmanueldegreatltd.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 12:51:43 GMT","end":"Sun, 06 Dec 2026 12:51:42 GMT"},"fingerprint":{"sha1":"6D:81:5D:19:86:1D:AB:D8:F2:EF:F6:E3:11:84:B9:57:89:96:EF:67","sha256":"05:BE:2D:DA:12:73:5D:8B:D3:66:FD:E7:CC:E4:1D:1C:81:A4:7D:15:03:B2:6C:A9:41:31:DE:DB:44:BC:72:BC"}}},"request":{"raw":"GET /image/profile.png HTTP/1.1\r\nHost: facebookbonus.emmanueldegreatltd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebookbonus.emmanueldegreatltd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Oct 2026 22:09:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Jul 2026 16:15:32 GMT\r\naccept-ranges: bytes\r\ncontent-length: 629070\r\ndate: Tue, 06 Oct 2026 22:09:23 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":629070,"size_decoded":629337,"mime_type":"image/png","magic":"PNG image data, 943 x 817, 8-bit/color RGBA, non-interlaced","md5":"86bacfa8239b8fe7a0f903b9d82910d7","sha1":"7a78f07ed6bff0fe8c3eb468ab1828db9e72cd7e","sha256":"057c1d5fc6e09d9b4514932338a352e62d9b09c6e2be73b4193d3115afddfc62","sha512":"5cdd4d1de06c9db85414d2cb6123de512849223237eb57299ad6dca3fafd439fa4b7d7396dd41cb4b72252dde60c9b8f10e21419f173c47f92700d8a15c84a24","ssdeep":"12288:Tae8IDT4/LNQ9hMUFdbweXwHjbhcEq2WDvxO+oGNjzy0ue+AneqeTi:G2Tqm9FxgHjFlq2WLxO+Xjzj+2lH","tlshash":"8ed4230ca1ae56af38c564375e70ba19cb1d00ab4850cb7d9c847372bd86f7e427c64e","first_seen":"2026-10-06T00:57:25.30474Z","last_seen":"2026-10-07T03:27:11.072422Z","times_seen":7,"resource_available":false,"data":null}},"time_used":635,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":514,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/image/meta.png","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebookbonus.emmanueldegreatltd.com/","date":"2026-10-06T22:09:23.374Z","timestamp":1791324563374,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.facebookbonus.emmanueldegreatltd.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 12:51:43 GMT","end":"Sun, 06 Dec 2026 12:51:42 GMT"},"fingerprint":{"sha1":"6D:81:5D:19:86:1D:AB:D8:F2:EF:F6:E3:11:84:B9:57:89:96:EF:67","sha256":"05:BE:2D:DA:12:73:5D:8B:D3:66:FD:E7:CC:E4:1D:1C:81:A4:7D:15:03:B2:6C:A9:41:31:DE:DB:44:BC:72:BC"}}},"request":{"raw":"GET /image/meta.png HTTP/1.1\r\nHost: facebookbonus.emmanueldegreatltd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebookbonus.emmanueldegreatltd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Oct 2026 22:09:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Jul 2026 16:30:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9035\r\ndate: Tue, 06 Oct 2026 22:09:23 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9035,"size_decoded":9300,"mime_type":"image/png","magic":"PNG image data, 738 x 318, 8-bit colormap, non-interlaced","md5":"ee5a56e68348da5bb4a55617239ba439","sha1":"7a77362f09d3d4e0791b5b8a35c6f6e26d06084a","sha256":"011d5b90ff54e16749cdc1b6b5114ff4e3787c06eb1c5a5cb78a8c2f56c8aef2","sha512":"18277ca9675025a083e63e05f008422b5cf88e48aa0d6cfe91efa83e6b25793b7242e96e4e4d5421f03e4d748d93fb319bfaf9526eacd8f9d59eb81efda3c5c2","ssdeep":"192:XLapjLd3V1G6ZaaOvMJicE4hn3mDgL+SN9uxW5+mdFb9GYYwvT:bapndG6Z+v3linl+SN4Q5+sFbYY7","tlshash":"2f129fe82f72d2ded735c678b8f38172909ea4d8ec575260139521b11a364ade58062f","first_seen":"2026-10-06T00:57:25.293875Z","last_seen":"2026-10-07T03:27:11.073134Z","times_seen":7,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"facebookbonus.emmanueldegreatltd.com/favicon.ico","fqdn":"facebookbonus.emmanueldegreatltd.com","domain":"emmanueldegreatltd.com","tld":"com"},"ip":{"addr":"147.124.219.81","port":443,"asn":396073,"as":"MAJESTIC-HOSTING-01","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://facebookbonus.emmanueldegreatltd.com/","date":"2026-10-06T22:09:23.728Z","timestamp":1791324563728,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.facebookbonus.emmanueldegreatltd.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 12:51:43 GMT","end":"Sun, 06 Dec 2026 12:51:42 GMT"},"fingerprint":{"sha1":"6D:81:5D:19:86:1D:AB:D8:F2:EF:F6:E3:11:84:B9:57:89:96:EF:67","sha256":"05:BE:2D:DA:12:73:5D:8B:D3:66:FD:E7:CC:E4:1D:1C:81:A4:7D:15:03:B2:6C:A9:41:31:DE:DB:44:BC:72:BC"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: facebookbonus.emmanueldegreatltd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://facebookbonus.emmanueldegreatltd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 06 Oct 2026 22:09:23 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-10-11T13:09:38.545996Z","times_seen":158753,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"facebookbonus.emmanueldegreatltd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}}]}