{"report_id":"8bc48df0-2089-41cc-8ded-d70291d021a2","version":6,"status":"done","tags":["meta","facebook","phishing","social","dyndns"],"date":"2026-01-14T13:27:18Z","url":{"schema":"https","addr":"theoldfacebook.ddns.net/","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":0,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/login.php","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"title":"Facebook – log in or sign up","dom":{"size":11743,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c0a0be1d4cb8adca2908600d271faa5f","sha1":"9752bfe725234266d390d7018d3233cf2ea7f257","sha256":"c5042483671886a078e6cc7d2ddcd2a59887046a15777c360fa8531a9defa9af","sha512":"d9db2bf521fbddaf71d043d6bc52a9050365f06fb62841d7ca28a5538a50e9d91ee099ad0849bebbccaee38b2e3b1b6c74fa8827cbc88d7f13daff35c3189328","ssdeep":"96:bwR95OaBEvZXJp3qoBFFz3qwLULqESQRMgj5O3QX9:bwYvZ5pjfxULqEtjf9","tlshash":"0132e34028a2dcb251ef09d819621d2d9dfc4303a2a5458dfa5d8bfb2fb3dadc677814","dom_hash":"domhash3cb6584da96c7023cc5dbd4d1a659033","first_seen":"2026-01-14T10:04:59.269146Z","last_seen":"2026-01-14T14:14:35.665898Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":0,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-18T13:27:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"theoldfacebook.ddns.net","ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"domain_registered":"2001-06-28","domain_rank":0,"first_seen":"2026-01-14T13:27:18.700111Z","last_seen":"2026-01-14T13:27:18.700111Z","alert_count":18,"request_count":6,"received_data":157738,"sent_data":3105,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T13:26:55.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nSet-Cookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nLocation: login.php\r\nContent-Length: 0\r\nKeep-Alive: timeout=120, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":12022,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T14:40:50.607373Z","times_seen":17856705,"resource_available":true,"data":null}},"time_used":287,"timings":{"blocked":112,"dns":11,"connect":44,"send":0,"wait":61,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/login.php","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T13:26:55.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET /login.php HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nKeep-Alive: timeout=120, max=999\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":12022,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"abc056be9963cb2f615cbe8137fd9d7f","sha1":"464f229a95cde14cb5c2d3fe1c1f22d25c47a3c7","sha256":"4cc53bfdc94b317a87e1518b0b4ee572f426a9cbbc5577ce0b21b8a2eea3a7c9","sha512":"ee10a84c2f65c6ecf6f306b23953a060718445532bcdc7f57ba357ff4419bbf799fd2f0e0e0568c9de5518b87c1bbe541a1f38c5294dd340a760f034952b196c","ssdeep":"96:rdgs2DuJJYsJnwJn5g0nKKX5g5cvudvvzRBL9Pi/ffs:rAQJYs6nlNXvudTX9os","tlshash":"7c42b2402882dc56a1ff89d859225d2dfdb8430382a5468dfa5d93fb2fb2dbcc677814","first_seen":"2026-01-14T10:04:59.275721Z","last_seen":"2026-01-14T14:14:35.666947Z","times_seen":3,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/css/style.css","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://theoldfacebook.ddns.net/login.php","date":"2026-01-14T13:26:55.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://theoldfacebook.ddns.net/login.php\r\nCookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 14 Jan 2026 06:03:44 GMT\r\nETag: \"94e8-64852dee8051c\"\r\nAccept-Ranges: bytes\r\nContent-Length: 38120\r\nKeep-Alive: timeout=120, max=998\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":38120,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"d43cefb24a9e999068664b80de8e33c4","sha1":"8e5fb1a06dc9b1a22e21a463d87000c793ace22b","sha256":"6f4195250386f984d4c32394cd8de5cc0a652765ab3f2e4cd37b8c695522ac12","sha512":"c275ec9120040398c5aa7f86d75dba2f866fe6361652a54400c7d307d3c1bb38332f7632eb21ac872fc18c784b8c1b543499048c4837eb0e0ff65cadc52f45bc","ssdeep":"384:x+q1RhUKWf+WCHrG5DHFnEFIYyd+b4Y8jUo2GzBmGP8:5LhUKY+lHrGNFnEJyd+b4DjhzBmGP8","tlshash":"410330a8ea0620037333aaa4bb720756f6661053870255bd7fe471649ff47bd8621fdc","first_seen":"2026-01-14T10:04:59.278886Z","last_seen":"2026-01-14T13:27:20.248687Z","times_seen":2,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/img/network.png","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theoldfacebook.ddns.net/login.php","date":"2026-01-14T13:26:55.809Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET /img/network.png HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://theoldfacebook.ddns.net/login.php\r\nCookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 10 Jan 2026 20:32:55 GMT\r\nETag: \"a645-6480e8bf6abc0\"\r\nAccept-Ranges: bytes\r\nContent-Length: 42565\r\nKeep-Alive: timeout=120, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":42565,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 537 x 195, 8-bit/color RGBA, non-interlaced","md5":"611f6ec2dd2c8bd10800f4fd22ebc9b3","sha1":"815362177047993ec4d00e05ce241ce231b0c7dc","sha256":"f4287d1528382e5a28f80ea974fe73f74c6516bcf60cdabfc3f6202f1f6da03f","sha512":"073dc8a6f9de005e5f77b457cdc754893d9c45def57e25623f754324d636da66e83aafd4f30010ba8fbc556b510b045f6bd6dbaf7e0e5d4a67dddf85e9b48f78","ssdeep":"768:QvaqYRA1rN0k1kaun7D+0efroRZd56WlV/TtK0F+UpALS3z:Qyq1Nv1kasi3Top9V/ZKUALUz","tlshash":"471301984b69f2b6f32b8734638d1e8c6c306a9ee83b98434bcf51d8859514cb675cf1","first_seen":"2023-05-03T10:47:58Z","last_seen":"2026-04-27T14:24:22.553946Z","times_seen":330,"resource_available":false,"data":null}},"time_used":352,"timings":{"blocked":121,"dns":1,"connect":51,"send":0,"wait":48,"receive":49,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/img/fb_logo2.png","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theoldfacebook.ddns.net/login.php","date":"2026-01-14T13:26:55.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET /img/fb_logo2.png HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://theoldfacebook.ddns.net/login.php\r\nCookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 10 Jan 2026 21:38:27 GMT\r\nETag: \"c34a-6480f76590bcd\"\r\nAccept-Ranges: bytes\r\nContent-Length: 49994\r\nKeep-Alive: timeout=120, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":49994,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 186 x 47, 8-bit/color RGBA, non-interlaced","md5":"22ef1e62c9df88d0b2425732e20a61a8","sha1":"c71c499e2a8163b9822fe823bf31d3257fc4aa19","sha256":"75c7dbd6d7c8da4d7aaad859fb51fa3bc67c1ad689b11aafb4a1934150c3c6d7","sha512":"dacfc34535d1003285ce9501a2eb0974612b9372089cf5d4f420f356316d23e2bdbd219f718acf64ce32b7ac8ef37fdcf96a511476d6f01169ff7d3ee2923f6f","ssdeep":"1536:UQl7Ld1L4htu+nYgnPGmv1a44Mp4WZy3ojdYcA34NJWFl1asne5z5rXd/N9dUHms:n","tlshash":"6023b617bf90e952c0858d328861d3e95761fc4eed428b0779cf6f6b7f9a6e24d06280","first_seen":"2026-01-14T10:04:59.282189Z","last_seen":"2026-01-14T13:27:20.249988Z","times_seen":2,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":122,"dns":0,"connect":48,"send":0,"wait":47,"receive":49,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"theoldfacebook.ddns.net/favicon.ico","fqdn":"theoldfacebook.ddns.net","domain":"theoldfacebook.ddns.net","tld":"ddns.net"},"ip":{"addr":"87.90.149.239","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theoldfacebook.ddns.net/login.php","date":"2026-01-14T13:26:56.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theoldfacebook.ddns.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 07:18:59 GMT","end":"Tue, 14 Apr 2026 07:18:58 GMT"},"fingerprint":{"sha1":"81:24:7B:D1:A7:42:23:2E:94:83:08:6F:9C:40:16:A9:6B:CE:75:05","sha256":"D3:46:DC:60:A6:00:4A:C6:9F:9C:6A:17:12:D7:22:FB:55:48:7C:6C:F9:16:8D:92:0E:87:F7:89:17:36:83:30"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: theoldfacebook.ddns.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://theoldfacebook.ddns.net/login.php\r\nCookie: PHPSESSID=bcdijtqpo0svsck54e7m4uq7294bako1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 14 Jan 2026 13:26:46 GMT\r\nServer: Apache\r\nVary: accept-language,accept-charset\r\nAccept-Ranges: bytes\r\nKeep-Alive: timeout=120, max=999\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=utf-8\r\nContent-Language: en\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1209,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"XML 1.0 document, ASCII text, with CRLF line terminators","md5":"ea53958aebedb457116be7e5530e4be7","sha1":"47fb9506cd430990a61567c638563fb1b11a50f6","sha256":"f82bd3aa7b3b69a41d9c04b0c705eff870690c8a04c57b57ead68b22bd72f32e","sha512":"3e58b47c7ca94c59ffc8af6904912602be6a6c312170a639bddeba64aa2fa31d0f59d355d3c9da9c83702564785c793692a6dd54ad901f80044cf91f3bcef1f2","ssdeep":"","tlshash":"13215e1d90836e8623f48ab8b5f6a229d36262c311f41b6cb611401bffb0750ece22dd","first_seen":"2026-01-14T10:04:59.273087Z","last_seen":"2026-01-14T13:27:20.250989Z","times_seen":2,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"theoldfacebook.ddns.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}