{"report_id":"6af1bdc8-27b0-4714-883a-d070248573c5","version":0,"status":"done","tags":["meta","facebook","phishing","social"],"date":"2026-08-08T00:57:50Z","url":{"schema":"http","addr":"login.fb20260701.com/","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"login.fb20260701.com/","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"title":"Facebook","dom":{"size":2080,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1288)","md5":"ca4c447f6b9b7d13029ad0fbe473129c","sha1":"c34b3075d5cfaaa2fe0cb9d1d9fb9d5346b7e076","sha256":"0a8bd087df85a5e96a1a00f626d74a2bbb1584666b7545ecb90ff25e6c33a7d8","sha512":"f30cede5c367d6932c4e42d35264202674fc052817eb61a757b894eba2d17ec21367af8697fe3d75de897d99408213f382a1b6bae6ec35126111e7e60d0685c5","ssdeep":"","tlshash":"0f4161269990680d03220d50fa75f61f92c6f61e8615ecc07dfc41aecfe2edcc457666","dom_hash":"domhash5d49eb3e2b37cce24ced9737a55e992e","first_seen":"2026-08-08T00:57:53.056371Z","last_seen":"2026-08-08T00:57:53.056371Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"login.fb20260701.com/","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-12T00:57:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"summary":[{"fqdn":"login.fb20260701.com","ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-07-01","domain_rank":0,"first_seen":"2026-08-08T00:56:02.006569Z","last_seen":"2026-08-08T00:56:02.006569Z","alert_count":30,"request_count":10,"received_data":1967909,"sent_data":4885,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"login.fb20260701.com/js/414.aCGy4j2eNQ.bf5a7bdb263f.9353cefa.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3055f696d9c2168426e10735dd908b3a","sha1":"6836f302fa375202679477407438ec7328d88cba","sha256":"f722494cfc68cbd6c91bac849b3b4b87fe2289e039fd2d0109a83f594d78bb91","sha512":"dfdbefc6e78cf1f09bf53ac2cfb3f536d58cf3b76620ec6d63fa0ec78bb70908c204997a2dc74de324c6eb8f906c51308064c4e612e40c72003725e4738327f1","ssdeep":"384:RHM8XguH48vAui2ZMdRAolA8hLLj1DqiGcR5pPP+JVT7UPUFU0UJJFZ:RHMpuYmAuJZMddOULLj1DhGcTpPP+JVC","tlshash":"1582a5c72fe6f532262d68a38913606456199a8b7e1c0444f13d2dd0bd95f38f17ba7c","size":18605,"data":"","first_seen":"2026-08-08T00:56:06.544257Z","last_seen":"2026-08-08T01:29:27.869298Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/chunk-vendors.aCGy4j2eNQ.bf5a7bdb263f.28438ea5.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"dcd886c508c412c3366e13a81afcd525","sha1":"16d38004d2d7c25a3ad52a565b2c452a2643fb7c","sha256":"7097c7dc21d22883846ce0908b8f2d3522499c2d8b8ca5833fa128eef6221eb5","sha512":"e6fa1730cce1d68995bff2c8075cdb51a3ad18a527afaa6a1c4765e971e0e934f0caee1cb8b4fdd5ed6cff1935be5f5dee301113b24464e6e24a2c04bf6dde3f","ssdeep":"12288:605ymFAy+7pW/aWprIumy7QsdWZMB9rig9/BUziy:60JJ+7pW/hNmy7Qskimzv","tlshash":"87f42bce3186b522479711b5403f290ab23e2f58680e8458f6a5f4da7d78d6c827bf7c","size":772570,"data":"","first_seen":"2026-08-08T00:56:06.547228Z","last_seen":"2026-08-08T01:29:27.886389Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/app.aCGy4j2eNQ.bf5a7bdb263f.7d99ea2f.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a538f6239c3451814fcda054714ead65","sha1":"b1ec95b22ca3edda90e250c70e38112f1c4941d1","sha256":"e6f2a9b3c657004af2e8aee68c015efd6abf3e4ed3a559595f1c61d6c1f2770d","sha512":"007b3db9509fd23e475c7f2e5d581afb1b5cfd870df371fbd86d3ccdb44bcc7900b2829bb780e685b7a27f0db6dc8e81a6979c91a59d8e2b6c27146c6b81695b","ssdeep":"12288:qQEcHQvDWxphYQodvsDUbqO7xJXRlWq5HMbjXi0vk4YJ378Olm:HJQvDWxphYQFMXRl9m9Yjm","tlshash":"ea1575768ac840b594e4247bd6a6f0b1e3e1f446bd0c42dbbe795c3ca1a919ce43dc6c","size":924944,"data":"","first_seen":"2026-08-08T00:56:06.543185Z","last_seen":"2026-08-08T01:29:27.885438Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"login.fb20260701.com/","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-08T00:57:13.549Z","timestamp":1786150633549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-4f9\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1273,"size_decoded":1046,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (563)","md5":"d1e78eca8a8952ac6ca600a518fe94cb","sha1":"c125e6c4e984dc78c5b4c1dacdd813162ece5536","sha256":"c774596aafcbf904d9e0fe102a194fdd4f96da7af74de4c7e45e7426caa381fe","sha512":"c2a40a9a7951ea5f3baebb06838a4dcd7c104fa9a18aadab95ca9a84dcec3a10ce06a82ccf11e758a0b20b8774bf9ed57949e9d40d40498be67ee63de2fe8573","ssdeep":"","tlshash":"77212146ad70640c17614a14fe75f22e8a85bc5e9510ecd0bcec91bdcf90bc8c593626","first_seen":"2026-08-08T00:56:06.546147Z","last_seen":"2026-08-08T01:29:27.884407Z","times_seen":3,"resource_available":false,"data":null}},"time_used":3998,"timings":{"blocked":0,"dns":6,"connect":1297,"send":0,"wait":1320,"receive":0,"ssl":2148},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/chunk-vendors.aCGy4j2eNQ.bf5a7bdb263f.28438ea5.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:17.723Z","timestamp":1786150637723,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /js/chunk-vendors.aCGy4j2eNQ.bf5a7bdb263f.28438ea5.js HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:17 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-bc9da\"\r\nexpires: Sat, 08 Aug 2026 12:57:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":772570,"size_decoded":221037,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2820)","md5":"dcd886c508c412c3366e13a81afcd525","sha1":"16d38004d2d7c25a3ad52a565b2c452a2643fb7c","sha256":"7097c7dc21d22883846ce0908b8f2d3522499c2d8b8ca5833fa128eef6221eb5","sha512":"e6fa1730cce1d68995bff2c8075cdb51a3ad18a527afaa6a1c4765e971e0e934f0caee1cb8b4fdd5ed6cff1935be5f5dee301113b24464e6e24a2c04bf6dde3f","ssdeep":"12288:605ymFAy+7pW/aWprIumy7QsdWZMB9rig9/BUziy:60JJ+7pW/hNmy7Qskimzv","tlshash":"87f42bce3186b522479711b5403f290ab23e2f58680e8458f6a5f4da7d78d6c827bf7c","first_seen":"2026-08-08T00:56:06.547228Z","last_seen":"2026-08-08T01:29:27.886389Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1444,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1444,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/app.aCGy4j2eNQ.bf5a7bdb263f.7d99ea2f.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:17.727Z","timestamp":1786150637727,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /js/app.aCGy4j2eNQ.bf5a7bdb263f.7d99ea2f.js HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:17 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 21:32:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555950-e1d10\"\r\nexpires: Sat, 08 Aug 2026 12:57:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":924944,"size_decoded":349605,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65510), with no line terminators","md5":"a538f6239c3451814fcda054714ead65","sha1":"b1ec95b22ca3edda90e250c70e38112f1c4941d1","sha256":"e6f2a9b3c657004af2e8aee68c015efd6abf3e4ed3a559595f1c61d6c1f2770d","sha512":"007b3db9509fd23e475c7f2e5d581afb1b5cfd870df371fbd86d3ccdb44bcc7900b2829bb780e685b7a27f0db6dc8e81a6979c91a59d8e2b6c27146c6b81695b","ssdeep":"12288:qQEcHQvDWxphYQodvsDUbqO7xJXRlWq5HMbjXi0vk4YJ378Olm:HJQvDWxphYQFMXRl9m9Yjm","tlshash":"ea1575768ac840b594e4247bd6a6f0b1e3e1f446bd0c42dbbe795c3ca1a919ce43dc6c","first_seen":"2026-08-08T00:56:06.543185Z","last_seen":"2026-08-08T01:29:27.885438Z","times_seen":3,"resource_available":true,"data":null}},"time_used":8428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/css/app.aCGy4j2eNQ.bf5a7bdb263f.aff7dfe5.css","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:17.730Z","timestamp":1786150637730,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /css/app.aCGy4j2eNQ.bf5a7bdb263f.aff7dfe5.css HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:17 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-12ed\"\r\nexpires: Sat, 08 Aug 2026 12:57:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4845,"size_decoded":2306,"mime_type":"text/css","magic":"ASCII text, with very long lines (4845), with no line terminators","md5":"a6f2ff96a52a2b595f9d61641645627e","sha1":"37609c6bacdf1029b3da7a891ec42de01634cef5","sha256":"d324524d1855f939370cee58bb7bcd9728fe5b48ac54058c1480c746190ffc08","sha512":"0583a4ea3ee6d9a09db0a92b0cb28dd8ec85b919d53dce66c4feea743a1375adda0f0e3b4e896212e8c004f9e1c9ca7432e69e8a94b43d81fbc14349cea105ab","ssdeep":"96:ODIUMAl/HkCjGXXO3OLHokkd9u1iP7V/O1J8wMkGOomM1YV:ODIU6Ck6sHokkTIiP7doJikGpmMe","tlshash":"6aa18735f180753ad03781aeff88ed4c81258952e6150febf64ba5115e4738b1870625","first_seen":"2026-08-08T00:56:06.538658Z","last_seen":"2026-08-08T01:29:27.866442Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/favicon.ico","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:20.733Z","timestamp":1786150640733,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:20 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\netag: \"6a555942-10be\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":4727,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"763a26ac1b333a2a3e4d3aaa7188b83f","sha1":"dab8d87df371792f84be587bc904781f1754b785","sha256":"cf2caf811a3e92e7913dfe4be696bb36c155ebff32ac0b62547c6b8233cbaab4","sha512":"95c59e667b4e1ccfde2ae3394ed16d757e90b0ca15cafa338ec79fb61acc9e8d73ce179a98660df242144da63e5793335a1f6b39b26f03117f8040e0413c80c9","ssdeep":"48:AcNTmQ9vq996VypcXlEnPgsUXhbJ7LI70JQucb0mMQksk13b+qYyCkWN4/:AcNTh1q996Vb2gsUpZRuWELkpmNc","tlshash":"c391dcc28d89416bc90aab7481862fc117370d9cb0ee5de559fc751a3bb3c8e51bf066","first_seen":"2024-10-29T06:16:42.130564Z","last_seen":"2026-08-08T01:29:27.879148Z","times_seen":55,"resource_available":false,"data":null}},"time_used":25941,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25941,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/414.aCGy4j2eNQ.bf5a7bdb263f.9353cefa.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:46.901Z","timestamp":1786150666901,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /js/414.aCGy4j2eNQ.bf5a7bdb263f.9353cefa.js HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:47 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 21:31:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555944-48ad\"\r\nexpires: Sat, 08 Aug 2026 12:57:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18605,"size_decoded":7826,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18585), with no line terminators","md5":"3055f696d9c2168426e10735dd908b3a","sha1":"6836f302fa375202679477407438ec7328d88cba","sha256":"f722494cfc68cbd6c91bac849b3b4b87fe2289e039fd2d0109a83f594d78bb91","sha512":"dfdbefc6e78cf1f09bf53ac2cfb3f536d58cf3b76620ec6d63fa0ec78bb70908c204997a2dc74de324c6eb8f906c51308064c4e612e40c72003725e4738327f1","ssdeep":"384:RHM8XguH48vAui2ZMdRAolA8hLLj1DqiGcR5pPP+JVT7UPUFU0UJJFZ:RHMpuYmAuJZMddOULLj1DhGcTpPP+JVC","tlshash":"1582a5c72fe6f532262d68a38913606456199a8b7e1c0444f13d2dd0bd95f38f17ba7c","first_seen":"2026-08-08T00:56:06.544257Z","last_seen":"2026-08-08T01:29:27.869298Z","times_seen":3,"resource_available":true,"data":null}},"time_used":539,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":539,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/css/chunk-vendors.aCGy4j2eNQ.bf5a7bdb263f.0d6e9997.css","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:17.729Z","timestamp":1786150637729,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /css/chunk-vendors.aCGy4j2eNQ.bf5a7bdb263f.0d6e9997.css HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:17 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-36e2c\"\r\nexpires: Sat, 08 Aug 2026 12:57:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":224812,"size_decoded":52803,"mime_type":"text/css","magic":"ASCII text, with very long lines (64226)","md5":"3f2d238f567878fc882262d15c0246e9","sha1":"afd22aa560041acb3ee50f1e8d102f84f598215b","sha256":"75724902161178f302b800e0a09bbce57cf0adab3ead8deac6722d8ca8ec2581","sha512":"6326237a5a5fc4abe3ae56e55abef9f70fd5ccf497a7235aeb00b239a4e2793d3439b9a2e152da800122f71475a68480b67c8fae00ed6940267ad3a283be1f0e","ssdeep":"6144:7kZUwh1nAukdDO3Xyr5Ir5eR0dTMA9S6fjKlWf:IZUwh1nAukdDO3Xyr5Ir5eR0dTMAEMf","tlshash":"6b24876f85d1135da1178e619fcc9ad8c22cc572a5520dedb242380e8fc7fde239a61b","first_seen":"2025-06-24T18:05:37.862283Z","last_seen":"2026-08-08T01:29:27.864902Z","times_seen":40,"resource_available":false,"data":null}},"time_used":8427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/css/414.aCGy4j2eNQ.bf5a7bdb263f.3af831cc.css","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:46.896Z","timestamp":1786150666896,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /css/414.aCGy4j2eNQ.bf5a7bdb263f.3af831cc.css HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-65c\"\r\nexpires: Sat, 08 Aug 2026 12:57:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1628,"size_decoded":1171,"mime_type":"text/css","magic":"ASCII text, with very long lines (1628), with no line terminators","md5":"2f367ba37d5d6078002ad0cbb10bb900","sha1":"3b987a372fdc569823a878ec3cd5aa604c485d6d","sha256":"de3f5c99d6a380b51f6615f5d79f902fb7bbb05f3e264adcb8e82e8afe898c75","sha512":"ecad822b3340e7bc2c843a6728ae6b28384a294948520aaf50cd2e58673e2fc5b5aedf88e2e13df848720fbbd6ce9332d14e5b1d7f3afdac237c63112d4c92a8","ssdeep":"","tlshash":"173134b243591029ac5fe32975a034dc003c9443db37862d14f67ba466db1c427bba6c","first_seen":"2026-08-08T00:56:06.539708Z","last_seen":"2026-08-08T01:29:27.887312Z","times_seen":3,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/css/805.aCGy4j2eNQ.bf5a7bdb263f.98623210.css","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:47.473Z","timestamp":1786150667473,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.fb20260701.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 01 Jul 2026 00:11:45 GMT","end":"Tue, 29 Sep 2026 00:11:44 GMT"},"fingerprint":{"sha1":"7B:B4:BE:7F:1F:94:63:0B:84:69:7F:4F:F1:B3:D2:50:39:F2:AF:C3","sha256":"16:29:30:3D:8E:9F:A8:45:F6:71:E5:34:77:6A:D8:D2:74:82:A7:9F:76:06:9E:F5:1F:AC:DC:6C:47:42:C9:5B"}}},"request":{"raw":"GET /css/805.aCGy4j2eNQ.bf5a7bdb263f.98623210.css HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 21:31:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555942-26b5\"\r\nexpires: Sat, 08 Aug 2026 12:57:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9909,"size_decoded":3144,"mime_type":"text/css","magic":"ASCII text, with very long lines (9909), with no line terminators","md5":"21d18191ce5862cadafc0bb4a6c4bf76","sha1":"47c7cf6b69a2a620c0c23870388ba28268550caa","sha256":"1ed6a9dafe8bc6bceb72d88a78abc8617b9e2e79d288c4a3385130cef4566da2","sha512":"fa7bf224e0f8430263454501134d15a75ec9b1db77a0cafef1888c74ced9384cdb6338638220078a35f36d03b47f6875c455e7284eee6a088851a1c065010b80","ssdeep":"192:828R6Hra6AC8TzA2Qg+YiejYFw8OsVLn1rmjdRM7Ia6zR9o6qIm2lCTub:rZAJT2Pejt8OsVLxB7IpzR9VqIhB","tlshash":"a912a518bd4c140af837c6e13dc88e8c4234d691fd934e88bb5ba5914e9f2cf272b684","first_seen":"2026-08-08T00:56:06.53243Z","last_seen":"2026-08-08T01:29:27.880197Z","times_seen":3,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"login.fb20260701.com/js/805.aCGy4j2eNQ.bf5a7bdb263f.12d4db32.js","fqdn":"login.fb20260701.com","domain":"fb20260701.com","tld":"com"},"ip":{"addr":"47.83.157.60","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login.fb20260701.com/","date":"2026-08-08T00:57:47.479Z","timestamp":1786150667479,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /js/805.aCGy4j2eNQ.bf5a7bdb263f.12d4db32.js HTTP/1.1\r\nHost: login.fb20260701.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.fb20260701.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 08 Aug 2026 00:57:47 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 21:31:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555948-6e00\"\r\nexpires: Sat, 08 Aug 2026 12:57:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T23:57:26.633165Z","times_seen":17845826,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login.fb20260701.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}}]}