{"report_id":"7181a1ea-4c71-4242-ad90-8da43ee0766a","version":6,"status":"done","tags":["meta","facebook","phishing","social"],"date":"2026-03-08T11:50:35Z","url":{"schema":"http","addr":"login.facebo0k.legal-lead-hub.com","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"title":"Facebook - Log In or Sign Up","dom":{"size":47259,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17499)","md5":"25f92e2fd7576f0468f5b436ee4144cf","sha1":"66e037ed6453f7288cf398ddde64d0840deaab27","sha256":"ed428cbb82f6d03421062521cb4cd0f9ee7aff666f37552aefad61747dc7e1b0","sha512":"2437ed86f2ffeaf4a133e0631f8f22bf0badf7e0c6eeb29e7369d96235e211a0d83e1a12b43d9a8594f771d9fe2d29aeae3f01ef672406950c86147ddb6e87d4","ssdeep":"768:61QhaCUpa23XjEVlZcnW+pFGfb5XEeHEp4pBBGqfhl:61QMZ7gH5XPHEuDBGqfL","tlshash":"57233c6b4a9211e53c17c3b5bebe5b4ad5644407c201cdb8fbbc6755cf8aca085e728c","dom_hash":"domhash193a968113b4970f62e2393375a213d1","first_seen":"2026-03-08T11:50:40.266095Z","last_seen":"2026-03-08T11:50:40.266095Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"login.facebo0k.legal-lead-hub.com","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":0,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-12T11:50:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-08T11:50:16Z","timestamp":1772970616,"ip_dst":{"addr":"Client IP","port":55510,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 17","source":"{\"timestamp\":\"2026-03-08T11:50:16.116357+0000\",\"flow_id\":289564052187691,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"94.154.35.155\",\"src_port\":443,\"dest_ip\":\"172.18.0.38\",\"dest_port\":55510,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400016,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 17\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2026-03-08T11:50:16.027179+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-08","alert":"Phishing Block","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"ns-server-isdjs-icons.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"summary":[{"fqdn":"rpc-mainnet.matic.quiknode.pro","ip":{"addr":"132.145.155.63","port":443,"asn":31898,"as":"ORACLE-BMC-31898","country":"United States","country_code":"US"},"domain_registered":"2018-01-05","domain_rank":2989773,"first_seen":"2021-05-19T17:40:41Z","last_seen":"2026-03-05T01:21:02.811116Z","alert_count":0,"request_count":2,"received_data":1129,"sent_data":1122,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ns-server-isdjs-icons.sbs","ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"domain_registered":"2026-03-05","domain_rank":0,"first_seen":"2026-03-07T00:16:00.803394Z","last_seen":"2026-03-07T00:16:00.803394Z","alert_count":4,"request_count":4,"received_data":77830,"sent_data":2164,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-03-01T22:28:03.022415Z","alert_count":0,"request_count":3,"received_data":379513,"sent_data":1674,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"polygon-rpc.com","ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"domain_registered":"2021-07-29","domain_rank":31782,"first_seen":"2021-10-02T16:12:28Z","last_seen":"2026-03-07T00:43:55.159663Z","alert_count":0,"request_count":2,"received_data":1416,"sent_data":1092,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"static.xx.fbcdn.net","ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"domain_registered":"2007-05-03","domain_rank":4147,"first_seen":"2012-12-01T13:12:13Z","last_seen":"2026-03-02T05:16:27.313583Z","alert_count":0,"request_count":1,"received_data":244202,"sent_data":479,"comment":"","tags":null,"fingerprints":null},{"fqdn":"login.facebo0k.legal-lead-hub.com","ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":10,"request_count":2,"received_data":32982,"sent_data":975,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"79ccaea1e7b34c6b600c0c36eb42792c","sha1":"5f9a1c99559281f1b1b80ab2957632c362d0b07a","sha256":"e312a7d209b5ce06887a835c9283da66d08c6b784ee56983886ad6ee3428350d","sha512":"44d3a84032ac1d9688db39e4ca910ea04014a4ca0820bafb33866441ed630950c77f512e3a0335c7d7921b59d56747ebf388fd263ceb9f7b4302984de433a564","ssdeep":"192:ISJEBVKgg9JuwBkMhjx9mEMEDzr9hsBToO52uZGUvsJCmO5Z1Mz91vscKBhrcgW/:hEUk+9mSrmZhvsJ/iZ1MwBhRfQ44","tlshash":"0242b6653d6384b542f800e100be5105f9bbeb1138cd80d4a5df9d560baf6aab1b7a2e","size":12804,"data":"","first_seen":"2026-03-08T10:10:39.392614Z","last_seen":"2026-03-09T20:10:25.416443Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"a81993ac8f6c36537c8d444a1be5b4c8","sha1":"f501a135eb71ec0db71da1cd32ec6280fbd627aa","sha256":"b8d62a367c6a1ced9cce8a9c60ab358f1e7429f138d693bad8c7b9aa90d3e932","sha512":"1c6870bb6f8e1a32b63bb1f8942a1df9a9f9275ddf6db097d66fad69a02579c367ebc69c0549c267f619c1b357a5685bb85909690a2fea6f366fe34fc0d14ea8","ssdeep":"384:mZcybJO9MIHHckFUaWbyxPmxHE1qpENRI25:mZcnW+pFGfo","tlshash":"39725c67db8bea9a2d2b835620b54fcfd980004a11105ce7fa427e9708751b1d6eb9cf","size":17501,"data":"","first_seen":"2026-03-08T10:10:39.393471Z","last_seen":"2026-03-09T20:10:25.417398Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ns-server-isdjs-icons.sbs/api/index.php?q=KqMLtwTHhgATvxIB-Nd35LGvyBe5mWeNf-D_","fqdn":"ns-server-isdjs-icons.sbs","domain":"ns-server-isdjs-icons.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"c5908d083b793fc3753c0d6d4edff9df","sha1":"edba1757ab0a8124cec385223dfe63e08fc0c783","sha256":"7c0824f72c4c641f2339ecf61fd0ff596c1313b003dcf50b89fed5b07c3733d7","sha512":"e15a75831238673e26642d91424ab178b3ec1d9f1ce020fe3f0144ada360ce1b1d89f2b73772d432af7d3c80ad14e892faaac2bac2dbae85c395fcec7dc05726","ssdeep":"768:F4XbFcujrlo/SPY1MJUDLG94nH9W6dkRyIyRodFUmHQTI4208f82Q6JHIItBCfCb:m+XW4HH6VCoRBtwfoxAbfMtCCt","tlshash":"eb735bcd6b84b38bf65044ada1e9d43c30b2b1b7ee99990ae077049457b8b365fccb40","size":74712,"data":"","first_seen":"2026-03-08T11:50:40.273944Z","last_seen":"2026-03-08T11:50:40.273944Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"introduction_type":"Function","is_inline":false,"md5":"4116b06ae9a2e42b8eea1cffb0c228a4","sha1":"937d426d83c94b0c96c9ca2a61bdcf1b6b0f4e1b","sha256":"3028489296a4d5d3e6565dad711e4161a914dd0a243bcd605e013cb5067a11b6","sha512":"860b6b539ff761e7621327d0516ddfcb96cd48f02bd3b36a49e0a601b9092eacf0fa78fcde51f7702d9e4f6ad1e3c7e7bc97730d8c95cebce30b2760b604a9e1","ssdeep":"768:jWan/Gc8sax5GZRkCM8Sonn2Y38n36fIuFEcGiGxr/So:aan/Gc8siGZSCMan1sKfHyiGxrb","tlshash":"8e4319b41cfb20305463205b536779107a688037e646d5f7ba9d872a0fc2952e6bfbec","size":55688,"data":"","first_seen":"2026-03-07T10:24:42.567269Z","last_seen":"2026-03-08T12:06:37.225404Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"polygon-rpc.com/","fqdn":"polygon-rpc.com","domain":"polygon-rpc.com","tld":"com"},"ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:14.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 03 Mar 2026 14:11:45 GMT","end":"Mon, 01 Jun 2026 14:11:44 GMT"},"fingerprint":{"sha1":"0D:BF:CA:17:2B:14:D7:45:C8:D0:42:AA:F0:9A:2E:C6:8F:63:64:4A","sha256":"20:41:C5:F3:2A:E3:AB:A9:63:D1:F0:DE:5A:49:A0:4D:BC:6B:BA:DD:BF:25:BD:24:08:8A:EC:D4:FF:3F:96:3C"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: polygon-rpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 08 Mar 2026 11:50:15 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version,x-client-name,x-client-version\r\naccess-control-max-age: 1728000\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":1432,"timings":{"blocked":682,"dns":44,"connect":64,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/v4/yg/r/_zMGyxjiiNp.png","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:14.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 15 Dec 2025 00:00:00 GMT","end":"Sun, 15 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:CE:7A:CE:E2:96:F9:EF:0C:85:E3:B0:51:A4:A8:0B:94:FB:5B:3E","sha256":"43:64:78:FF:48:82:32:04:F6:05:75:34:82:8A:78:B3:74:FD:17:3F:BD:33:D1:74:96:37:EB:1B:95:07:81:EA"}}},"request":{"raw":"GET /rsrc.php/v4/yg/r/_zMGyxjiiNp.png HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: 23rC0v0hhZMVDhyvt3C9IQ==\r\nexpires: Sun, 07 Mar 2027 14:24:31 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: FdcU2OOqg/ZsqUIeDQXZJSiTg//FXU4Ps9vLRZtq/nCDu4q4ccZz9wCwhgQZ6RxPwP7IoDKODfXnf77i4gve/w==\r\ncontent-length: 242279\r\ndate: Sun, 08 Mar 2026 11:50:15 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=38, rtx=3, c=12, mss=1380, tbw=3428, tp=-1, tpl=-1, uplat=0, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":242279,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1240 x 1240, 8-bit colormap, non-interlaced","md5":"db7ac2d2fd218593150e1cafb770bd21","sha1":"c31ada2878164044f9a04d439acbe03a87616ccb","sha256":"2ca8e788cd26d1f8bb6c3b1f226cbdc8a8ea195e47391b6603cf060d2097c94a","sha512":"ab7fae9149a7c8a38f4b6c01738059fa6db1d538320712ac624363a9d847e031e22c979ad71d54710cbbcbb0a9182dee7a90fa1afd65f9af706fbaa7562ec5ea","ssdeep":"6144:TfJlGHvGeUVC3unI9yyHZryo/HZGVDy7fBcMGPbkZwN13:NUHvX3unI9ysZrFIE1cxie3","tlshash":"113423da96aa3e5cc7bfd86230501109850bf45c8c4a709aecda7d8ef739ca00759f9d","first_seen":"2025-12-29T19:14:46.047059Z","last_seen":"2026-05-26T19:34:14.10888Z","times_seen":326,"resource_available":false,"data":null}},"time_used":1589,"timings":{"blocked":572,"dns":3,"connect":39,"send":0,"wait":40,"receive":402,"ssl":530},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/favicon.ico","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:14.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.facebo0k.legal-lead-hub.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 12:32:30 GMT","end":"Fri, 05 Jun 2026 12:32:29 GMT"},"fingerprint":{"sha1":"76:25:A8:72:E3:33:7A:28:5B:9A:57:7F:96:7F:66:CC:9A:C3:DA:1B","sha256":"F6:94:A0:52:C7:BF:A0:5F:DE:5E:FA:EA:A6:5C:51:5E:29:BD:98:EB:B2:4C:27:0B:17:8A:F4:79:7A:6D:9B:B5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: login.facebo0k.legal-lead-hub.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 08 Mar 2026 11:50:14 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"37d5c3a24983196361e6ce9b1a499464","sha1":"2dd5878df894f3c648e42408879e9a61c112d1b3","sha256":"766c1d6bcb81d3e983fb7adbc19c616d7fc01dafb7893738edc242e2adc59c07","sha512":"cc140d1f61a01ba5f282d682dfeb19229426c7164b147a3031d3b5544c2d7213ce19b075a81d5e00750bdac7b1d9232b8b971e026d838ccae9466523338b09a9","ssdeep":"","tlshash":"eac08c6e2513bd4cc663217432c36490c08b93a7a4ea42228440805331cb2aa8ac7396","first_seen":"2023-11-07T17:46:00Z","last_seen":"2026-08-22T20:43:37.68114Z","times_seen":30383,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-08","alert":"Phishing Block","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"polygon-rpc.com/","fqdn":"polygon-rpc.com","domain":"polygon-rpc.com","tld":"com"},"ip":{"addr":"173.244.207.30","port":443,"asn":13213,"as":"UK-2 Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:15.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"enterprise.onerpc.com","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 03 Mar 2026 14:11:45 GMT","end":"Mon, 01 Jun 2026 14:11:44 GMT"},"fingerprint":{"sha1":"0D:BF:CA:17:2B:14:D7:45:C8:D0:42:AA:F0:9A:2E:C6:8F:63:64:4A","sha256":"20:41:C5:F3:2A:E3:AB:A9:63:D1:F0:DE:5A:49:A0:4D:BC:6B:BA:DD:BF:25:BD:24:08:8A:EC:D4:FF:3F:96:3C"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: polygon-rpc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x8D68F1033407104cFCC0b084Adc84bABaA7930C0\",\"data\":\"0xb68d1809\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 401 Unauthorized\r\ndate: Sun, 08 Mar 2026 11:50:15 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 101\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\nx-shark-trace-id: 9a3b09c078142c5fda51cee9c1b42048\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client,client-sdk-version,client-sdk-type,client-target-api-version,x-ton-client-version,x-client-name,x-client-version\r\naccess-control-max-age: 1728000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"401","status_text":"Unauthorized","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":101,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"60e513ddcb42e9781ab93f4365a0b016","sha1":"e8ae44e48567b3fb3b01a51f322baa4706ee5c95","sha256":"aa5ef750f317bb85a6bb250dbe3ce8d4be85e8363b90f7e71b02fa9be0ee7af9","sha512":"d32a511243e1ad1caf1bf79916938de391091b107fd08db0e64e97082380c702c13024c6e0e3d41ed30f3d455c5aace8201bc9c210a9c57cbf19af62afca0f84","ssdeep":"","tlshash":"8eb0129282406a060a0dc24be5381105934d2843433338304c19739c233f902cbc0e10","first_seen":"2026-02-20T07:45:51.844658Z","last_seen":"2026-06-25T05:43:28.206293Z","times_seen":139,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc-mainnet.matic.quiknode.pro/","fqdn":"rpc-mainnet.matic.quiknode.pro","domain":"quiknode.pro","tld":"pro"},"ip":{"addr":"132.145.155.63","port":443,"asn":31898,"as":"ORACLE-BMC-31898","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:15.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.matic.quiknode.pro","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 19:00:00 GMT","end":"Sun, 31 May 2026 18:59:59 GMT"},"fingerprint":{"sha1":"02:83:6D:DB:CA:18:CD:B3:5C:F5:94:9D:AC:8F:3E:87:CD:9C:DA:DF","sha256":"98:DA:12:2E:FC:0F:89:2D:D2:11:9F:81:3F:A0:62:53:A5:75:D7:97:B9:13:44:7A:9D:19:C5:66:C7:43:B1:FA"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: rpc-mainnet.matic.quiknode.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Content-Type,Authorization,User-Agent\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: https://login.facebo0k.legal-lead-hub.com\r\nvary: Accept-Encoding\r\nx-node-id: polygon_matic_iad\r\ncontent-length: 0\r\ndate: Sun, 08 Mar 2026 11:50:15 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":899,"timings":{"blocked":305,"dns":45,"connect":124,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rpc-mainnet.matic.quiknode.pro/","fqdn":"rpc-mainnet.matic.quiknode.pro","domain":"quiknode.pro","tld":"pro"},"ip":{"addr":"132.145.155.63","port":443,"asn":31898,"as":"ORACLE-BMC-31898","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:15.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.matic.quiknode.pro","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 19:00:00 GMT","end":"Sun, 31 May 2026 18:59:59 GMT"},"fingerprint":{"sha1":"02:83:6D:DB:CA:18:CD:B3:5C:F5:94:9D:AC:8F:3E:87:CD:9C:DA:DF","sha256":"98:DA:12:2E:FC:0F:89:2D:D2:11:9F:81:3F:A0:62:53:A5:75:D7:97:B9:13:44:7A:9D:19:C5:66:C7:43:B1:FA"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: rpc-mainnet.matic.quiknode.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nContent-Type: application/json\r\nContent-Length: 136\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":136,"data":"{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0x8D68F1033407104cFCC0b084Adc84bABaA7930C0\",\"data\":\"0xb68d1809\"},\"latest\"],\"id\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Content-Type,Authorization,User-Agent\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: https://login.facebo0k.legal-lead-hub.com\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\nx-host-id: f1b546936d23e3b5-767ad57defe39d4d\r\nx-node-id: polygon_matic_iad\r\ncontent-length: 295\r\ndate: Sun, 08 Mar 2026 11:50:15 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":295,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0801006022351cb9dbda6d1323234ead","sha1":"a1ac5dd2870f1848aadada5161da27417618973c","sha256":"30aa3c3d54214a1b57b2386388648bcbb176b16c30f72d81f036c0ed2d1cdb77","sha512":"90abd96af24e8f3dee7f706185b87e5ff9d82a140f459fd7ba785ef294939e958e8727f8d5804c05fe5cb6a74cbc7140d620a80aab90756117a2c23515a41ec3","ssdeep":"","tlshash":"66e012e0021b4a30e1ac6f8c710efa4a23237e4b49cc3e83c85c4cc013423c532902bb","first_seen":"2026-03-07T00:16:05.094735Z","last_seen":"2026-03-09T20:10:25.401348Z","times_seen":7,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ns-server-isdjs-icons.sbs/api/index.php?q=_Kq9hFiQCmv4j2HhHw","fqdn":"ns-server-isdjs-icons.sbs","domain":"ns-server-isdjs-icons.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:19.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ns-server-isdjs-icons.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 13:00:08 GMT","end":"Wed, 03 Jun 2026 13:00:07 GMT"},"fingerprint":{"sha1":"86:82:44:46:C4:71:8F:73:02:2F:27:71:D3:10:39:F3:48:38:FD:F9","sha256":"53:57:C1:FF:43:9C:DA:BF:B0:42:B6:F8:58:C8:5C:FC:B8:E3:A9:BB:46:21:9B:53:AD:26:79:62:9D:1D:41:24"}}},"request":{"raw":"OPTIONS /api/index.php?q=_Kq9hFiQCmv4j2HhHw HTTP/1.1\r\nHost: ns-server-isdjs-icons.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Sun, 08 Mar 2026 11:50:19 GMT\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\nsurrogate-control: no-store\r\npragma: no-cache\r\nexpires: 0\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\naccess-control-allow-origin: https://login.facebo0k.legal-lead-hub.com\r\nvary: Origin\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, X-Requested-With\r\naccess-control-allow-credentials: false\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":1288,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1286,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"ns-server-isdjs-icons.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ns-server-isdjs-icons.sbs/api/index.php?q=_Kq9hFiQCmv4j2HhHw","fqdn":"ns-server-isdjs-icons.sbs","domain":"ns-server-isdjs-icons.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:20.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ns-server-isdjs-icons.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 13:00:08 GMT","end":"Wed, 03 Jun 2026 13:00:07 GMT"},"fingerprint":{"sha1":"86:82:44:46:C4:71:8F:73:02:2F:27:71:D3:10:39:F3:48:38:FD:F9","sha256":"53:57:C1:FF:43:9C:DA:BF:B0:42:B6:F8:58:C8:5C:FC:B8:E3:A9:BB:46:21:9B:53:AD:26:79:62:9D:1D:41:24"}}},"request":{"raw":"POST /api/index.php?q=_Kq9hFiQCmv4j2HhHw HTTP/1.1\r\nHost: ns-server-isdjs-icons.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nContent-Type: application/json\r\nContent-Length: 141\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":141,"data":"{\"eventType\":\"recaptcha_shown\",\"browser\":\"Firefox\",\"os\":\"windows\",\"mode\":\"cf_update\",\"referrer\":\"https://login.facebo0k.legal-lead-hub.com/\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 08 Mar 2026 11:50:20 GMT\r\ncontent-type: application/json; charset=utf-8\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\nsurrogate-control: no-store\r\npragma: no-cache\r\nexpires: 0\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\naccess-control-allow-origin: https://login.facebo0k.legal-lead-hub.com\r\nvary: Origin\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, X-Requested-With\r\naccess-control-allow-credentials: false\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0f0479874bf6f4a7281099b15df27c27","sha1":"55a490e280d48996e564d00492437eb17faadd28","sha256":"a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288","sha512":"2c75ba98532392f27ff21ee337200edf6612b032c29d6005d66b7a974bc43f4496779c7c807a5c06a34f9dddffbf9c18647ff5c1f99cb48b113399efc3460c52","ssdeep":"","tlshash":"60600000000c00000cc00c00000c00303fff0fc0003f00c0000c00300f000c0c00c000","first_seen":"2023-04-05T03:59:49Z","last_seen":"2026-08-22T22:53:39.9882Z","times_seen":35131,"resource_available":true,"data":null}},"time_used":1467,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1467,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"ns-server-isdjs-icons.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"login.facebo0k.legal-lead-hub.com/","fqdn":"login.facebo0k.legal-lead-hub.com","domain":"legal-lead-hub.com","tld":"com"},"ip":{"addr":"185.107.74.34","port":443,"asn":200430,"as":"WEBO LLC","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-08T11:50:13.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.facebo0k.legal-lead-hub.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 12:32:30 GMT","end":"Fri, 05 Jun 2026 12:32:29 GMT"},"fingerprint":{"sha1":"76:25:A8:72:E3:33:7A:28:5B:9A:57:7F:96:7F:66:CC:9A:C3:DA:1B","sha256":"F6:94:A0:52:C7:BF:A0:5F:DE:5E:FA:EA:A6:5C:51:5E:29:BD:98:EB:B2:4C:27:0B:17:8A:F4:79:7A:6D:9B:B5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: login.facebo0k.legal-lead-hub.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 08 Mar 2026 11:50:13 GMT\r\nContent-Type: text/html\r\nLast-Modified: Sat, 07 Mar 2026 12:32:56 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69ac1af8-7e6e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32366,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17499)","md5":"6b88266637da4a74d80b125267845a69","sha1":"154292bd81fd4873b15ca784725fe68cfbaa65cb","sha256":"1545d8c6036b3a4dec7291ee6f197ab6bda97c62cd7bf92960d1763b989f28f5","sha512":"e1ac7a3707b50dbc356d58f81671c4804ecf95c4b42906c98c0cf580ea4355c9bf56350ba29ff21845e5b015f002301639ccec551fa1be831fd90df2729ad695","ssdeep":"384:K1QhaThJE1G6zhm2VUxZcybJO9MIHHckFUaWbyxPmxHE1qpENRI2q:K1Qha9JEVmZcnW+pFGfx","tlshash":"fae26c9b9be7566b7c07c3a827f60b4a659440079101cd587eac7b8b4fa25e0ce937cc","first_seen":"2026-03-08T10:10:39.384132Z","last_seen":"2026-03-09T20:10:25.404408Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1233,"timings":{"blocked":533,"dns":33,"connect":72,"send":0,"wait":166,"receive":1,"ssl":425},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-08","alert":"Phishing Block","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"login.facebo0k.legal-lead-hub.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"ns-server-isdjs-icons.sbs/api/index.php?q=IXS5qZD0jZdvNWZ_Kg","fqdn":"ns-server-isdjs-icons.sbs","domain":"ns-server-isdjs-icons.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:15.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ns-server-isdjs-icons.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 13:00:08 GMT","end":"Wed, 03 Jun 2026 13:00:07 GMT"},"fingerprint":{"sha1":"86:82:44:46:C4:71:8F:73:02:2F:27:71:D3:10:39:F3:48:38:FD:F9","sha256":"53:57:C1:FF:43:9C:DA:BF:B0:42:B6:F8:58:C8:5C:FC:B8:E3:A9:BB:46:21:9B:53:AD:26:79:62:9D:1D:41:24"}}},"request":{"raw":"GET /api/index.php?q=IXS5qZD0jZdvNWZ_Kg HTTP/1.1\r\nHost: ns-server-isdjs-icons.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 08 Mar 2026 11:50:16 GMT\r\ncontent-type: application/json; charset=utf-8\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\nsurrogate-control: no-store\r\npragma: no-cache\r\nexpires: 0\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\naccess-control-allow-origin: https://login.facebo0k.legal-lead-hub.com\r\nvary: Origin\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, X-Requested-With\r\naccess-control-allow-credentials: false\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":550,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"600d9a3d7460ee2b6acf11feb7c0fa92","sha1":"ed12d37099a33f9b5aa601b85ff87a2b36fe3c24","sha256":"9f2ba60811b1a437046175364e2298520850758e3773ba64f86d1a0862a90b57","sha512":"7b132b78c34525721cb963ad38fd9bae089626b0c17f7c08d4dd7f461312e69b95fe4e9f6bc5234985d0a84fcdff096ca310ff0ce20866b35ed167f3e362e9b3","ssdeep":"","tlshash":"fdf0ac95024a6a7a946a458de729465833ccf4c9dd94a11e5817d8575c1339d802524a","first_seen":"2026-03-08T11:50:40.273066Z","last_seen":"2026-03-08T11:50:40.273066Z","times_seen":1,"resource_available":false,"data":null}},"time_used":659,"timings":{"blocked":277,"dns":89,"connect":89,"send":0,"wait":105,"receive":0,"ssl":96},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"ns-server-isdjs-icons.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ns-server-isdjs-icons.sbs/api/index.php?q=KqMLtwTHhgATvxIB-Nd35LGvyBe5mWeNf-D_","fqdn":"ns-server-isdjs-icons.sbs","domain":"ns-server-isdjs-icons.sbs","tld":"sbs"},"ip":{"addr":"94.154.35.155","port":443,"asn":215567,"as":"Emirhan Kurt","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:16.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ns-server-isdjs-icons.sbs","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 13:00:08 GMT","end":"Wed, 03 Jun 2026 13:00:07 GMT"},"fingerprint":{"sha1":"86:82:44:46:C4:71:8F:73:02:2F:27:71:D3:10:39:F3:48:38:FD:F9","sha256":"53:57:C1:FF:43:9C:DA:BF:B0:42:B6:F8:58:C8:5C:FC:B8:E3:A9:BB:46:21:9B:53:AD:26:79:62:9D:1D:41:24"}}},"request":{"raw":"GET /api/index.php?q=KqMLtwTHhgATvxIB-Nd35LGvyBe5mWeNf-D_ HTTP/1.1\r\nHost: ns-server-isdjs-icons.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 08 Mar 2026 11:50:17 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nx-robots-tag: noindex, nofollow, noarchive, nosnippet\r\nsurrogate-control: no-store\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, X-Requested-With\r\naccess-control-allow-credentials: false\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74712,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c5908d083b793fc3753c0d6d4edff9df","sha1":"edba1757ab0a8124cec385223dfe63e08fc0c783","sha256":"7c0824f72c4c641f2339ecf61fd0ff596c1313b003dcf50b89fed5b07c3733d7","sha512":"e15a75831238673e26642d91424ab178b3ec1d9f1ce020fe3f0144ada360ce1b1d89f2b73772d432af7d3c80ad14e892faaac2bac2dbae85c395fcec7dc05726","ssdeep":"768:F4XbFcujrlo/SPY1MJUDLG94nH9W6dkRyIyRodFUmHQTI4208f82Q6JHIItBCfCb:m+XW4HH6VCoRBtwfoxAbfMtCCt","tlshash":"eb735bcd6b84b38bf65044ada1e9d43c30b2b1b7ee99990ae077049457b8b365fccb40","first_seen":"2026-03-08T11:50:40.273944Z","last_seen":"2026-03-08T11:50:40.273944Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1233,"timings":{"blocked":303,"dns":1,"connect":90,"send":0,"wait":626,"receive":0,"ssl":210},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-08","alert":"Sinkholed","trigger":"ns-server-isdjs-icons.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:19.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.1/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://login.facebo0k.legal-lead-hub.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Mar 2026 11:50:19 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18861\r\ncf-ray: 9d919f22ddf88be6-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"65692999-49ad\"\r\nlast-modified: Fri, 01 Dec 2023 00:32:25 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 758304\r\nexpires: Fri, 26 Feb 2027 11:50:19 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=OLnW48KuQojsbLkkLSw0gxCgMUZ057FKNDXn8n8HTCWcpxIJ3N20XRICwPGnZsz5osbF%2FSc0k2af4i0COWWN9NjnaCSDIVqibHqY9CQlWN7zYs%2BmAsYZgK6SB3pvuLa0NeodlRpz\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102641,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"9402848c3d4bbc710c764326f8b887c9","sha1":"b6e555166eb1381392e00adcde9bf8863f16ff01","sha256":"c22cfb6520a7fdbb738632834019acf47c78b1279462c0eb4cb83bae83ecb5a7","sha512":"0d33903bd456087de9a46a9c59a100d41219382eb1c5a97012cc3d73641078021fb65f957a0a2f96779ed5cf505f84dcb6758c9f5dd36727be822326f1ed8bc0","ssdeep":"1536:iwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgSLCJ:O709gMGFiyPG9ZiSLCJ","tlshash":"79a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-08-22T23:21:03.068848Z","times_seen":35117,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":94,"dns":1,"connect":36,"send":0,"wait":65,"receive":67,"ssl":54},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/webfonts/fa-brands-400.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:19.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.1/webfonts/fa-brands-400.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Mar 2026 11:50:19 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 117372\r\ncf-ray: 9d919f249f408be6-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"65692999-1ca7c\"\r\nlast-modified: Fri, 01 Dec 2023 00:32:25 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1535559\r\nexpires: Fri, 26 Feb 2027 11:50:19 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=ztyRPq6b%2FyeeP6ag%2BcrLGKnU0GRVY%2FjLK6wBy4z%2BND%2BEG%2BnAfLNfaQ6A9SJ8Ac9USREuQ%2BONg3jNdPX7yqZwH1X1jfZCsw4O2GInrUm%2BiBk5wUYprZjG2XCzKHl1MHNr3SBEfepO\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":117372,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 117372, version 773.768","md5":"b6356c957274676e6571c1ff5e11c9a8","sha1":"4022f95e001d734ca8f082b8e7627abd205609ec","sha256":"3a8924cd5203a28628716aedb5cef0943da4c3b44e3ffcee90ab06387b41c490","sha512":"83de79c74480fafc62cdac4012ff2a129d8701772ee16216c3d9488826ac21a9c2f8a416fe3208a61bfea7e12c24ac1cc2d26f6d22bd2b0ba39a22d630238b59","ssdeep":"3072:U3JKgVzg5ybfXYe5W59JPQaPWKSsx/DBMnVnqedkAFqPQTzIBIOK2vDMF:IVM5A5GJPQaH/NMtBkAvcnYF","tlshash":"c4b312f88b7ac9a5e304e67b55e4613555a0aec8b180f35453be7c2c221e10dc67afe3","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-08-22T23:22:46.552745Z","times_seen":30513,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":216,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://login.facebo0k.legal-lead-hub.com/","date":"2026-03-08T11:50:19.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.1/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://login.facebo0k.legal-lead-hub.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 08 Mar 2026 11:50:19 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 156496\r\ncf-ray: 9d919f24afa18be6-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"65692999-26350\"\r\nlast-modified: Fri, 01 Dec 2023 00:32:25 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 381097\r\nexpires: Fri, 26 Feb 2027 11:50:19 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=lESPWwBTzHPi1Z6wT9OB8lS5HTbHFpztYAlwE0ScM0IEuNbZdzKOVLxKwahOIZwhQYTR7HARxed6iE5TRKYLzD28kxPxRBRp4rB1UukqMW35dEDZjwieb6GuK402l9RNeXOM65lu\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":156496,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 156496, version 773.768","md5":"6c4eee562650e53cee32496bdfbe534b","sha1":"1aae708e3b94ee981b452a918d28ed037fbb5e18","sha256":"9fc85f3a4544ab0d570c7f8f9bbb88db8d92c359b2707580ea8b07c75673eae2","sha512":"ebcb5a2e2a908228f77ecd03b45491778cad73ddc39fa3a6334b129aaf9fa36c16c0307aeaad74d77f616b5b34aac52d91e9f4816945253dc9a826ddd71f4d12","ssdeep":"3072:OvM6gZMLmY8uGpjVnlooQ+GQs8jic0f/KkMdE:OU65LoP5QSsuic0f/cdE","tlshash":"8ce31200d620498d9978fd5b2a1fa1ffa7a939c95ed210bad3c30cb93257143bbc2556","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-08-22T23:12:40.07228Z","times_seen":50795,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":216,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}