{"report_id":"ebb906f0-e6e2-428d-98af-1efd6ada4898","version":0,"status":"done","tags":[],"date":"2026-09-07T09:12:16Z","url":{"schema":"https","addr":"p.91syun.com/extdomains/ja-jp.facebook.com/login?_fb_noscript=1","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"title":"Error","dom":{"size":5387,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3106)","md5":"705b8d9f4383928d99f7fad37db831c8","sha1":"dc6917b5fd0c590f6ce31280d577c00ab35c5c7d","sha256":"0913f8fe7e87bf68c3143a9e243e59367d56e842f64b9567804fd16cecb019d6","sha512":"881c1fcece64fb51c23778e0247196f1e97a49c29474eb8d9d70f3b22d0e0d04213f9984c96d2fd412d9e97dd09f17e74ba8262c0c94b1fb5fab77838f1b34bb","ssdeep":"96:Jwwmff8xeUvtCSZiYxn78ngKJy9/W+417lUOdF24n0uOdF5ubOdFWW6az:JwDIDtzB7ze+4hUOdwyHOdfqOdxL","tlshash":"bab1d8229281342ab43b89a1f5917bdc7191411fc7a30e29fd365237ebcb9b666133dc","dom_hash":"domhash48495b492c15d3f0dd50e63485a6307b","first_seen":"2026-09-07T09:12:17.399052Z","last_seen":"2026-09-07T09:12:17.399052Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"p.91syun.com/extdomains/ja-jp.facebook.com/login?_fb_noscript=1","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-12T09:12:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"p.91syun.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"p.91syun.com","ip":{"addr":"119.28.142.222","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"domain_registered":"2017-07-05","domain_rank":0,"first_seen":"2026-08-31T14:46:52.424281Z","last_seen":"2026-08-31T14:46:52.424281Z","alert_count":16,"request_count":4,"received_data":27576,"sent_data":2274,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.57","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"static.xx.fbcdn.net","ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"domain_registered":"2007-05-03","domain_rank":4147,"first_seen":"2012-12-01T13:12:13Z","last_seen":"2026-08-31T16:15:54.688433Z","alert_count":0,"request_count":5,"received_data":38542,"sent_data":2800,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"p.91syun.com/extdomains/ja-jp.facebook.com/login?_fb_noscript=1","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-07T09:11:39.989Z","timestamp":1788772299989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"p.91syun.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 16:07:03 GMT","end":"Thu, 29 Oct 2026 16:07:02 GMT"},"fingerprint":{"sha1":"10:68:1A:3B:05:11:A4:F7:A8:E9:A7:7A:90:C0:97:A0:C3:73:D4:4D","sha256":"4B:29:43:5C:1F:3F:10:15:A6:64:0E:5D:FA:92:3B:D2:90:DF:85:73:B8:08:0C:B8:C4:5A:71:E7:9F:9E:F9:F1"}}},"request":{"raw":"GET /extdomains/ja-jp.facebook.com/login?_fb_noscript=1 HTTP/1.1\r\nHost: p.91syun.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 \r\naccess-control-allow-origin: *\r\ncontent-length: 331\r\nlocation: https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 07 Sep 2026 09:11:41 GMT\r\nserver: Apache/2.4.57 (Ubuntu)\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.57","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-07T11:14:23.67375Z","times_seen":18328105,"resource_available":true,"data":null}},"time_used":1248,"timings":{"blocked":-1,"dns":6,"connect":309,"send":0,"wait":311,"receive":0,"ssl":622},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"p.91syun.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/yE/r/2XZbzaohp3N.webp","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.008Z","timestamp":1788772302008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 16 Jun 2026 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"5E:E4:F6:C6:9C:00:73:FF:1B:D7:1B:E5:6C:2B:88:EE:55:C7:03:3B","sha256":"6D:B2:1F:62:28:49:76:AE:FC:C1:3A:19:51:4A:60:EB:32:53:AB:10:7C:F2:E8:8F:BD:94:F2:5A:AF:CE:04:04"}}},"request":{"raw":"GET /rsrc.php/yE/r/2XZbzaohp3N.webp HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://p.91syun.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: image/webp\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: CYxn0L+bDrrEcpK6gFtYdQ==\r\nexpires: Fri, 27 Aug 2027 01:35:42 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\nx-ua-compatible: IE=edge\r\norigin-agent-cluster: ?1\r\nx-fb-debug: 7Uh4Kdty4bsMnrENv6WsGeOoR/gYy++W5iMLedV08RqhwtN5N97LZPInlYP5oDRIzAcQwuWPoFz/eDHuYrESCg==\r\ncontent-length: 6958\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=20588, tp=24, tpl=0, uplat=3, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=6,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6958,"size_decoded":8901,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"098c67d0bf9b0ebac47292ba805b5875","sha1":"99baae4fd93cc793a3b8c46cbfa30d5a5ab2f2a5","sha256":"121e22f35961bf6f33c83165806a8ceabd56604634a58bf7a6ce038903c50aa8","sha512":"513ef4bd94a9a4334ed360342cea68fe5d67fb4f9ea4ba5a1e2661927c085240b2f82c11fb203677449a91196104dd344843de21fe53261d20100642b31b51e8","ssdeep":"192:s7SE7+194G1wdgsXht/hA2hOfvQE8EYt8T:sOEw4G1wLhtpAmOfka","tlshash":"25e19e5776d892055ad318cfcffefe700df2e4b827019a450ef08adede208e51a59586","first_seen":"2026-08-31T14:46:54.356578Z","last_seen":"2026-09-07T09:12:17.40174Z","times_seen":4,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/ys/r/sAUxDo4kERf.webp","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.014Z","timestamp":1788772302014,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 16 Jun 2026 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"5E:E4:F6:C6:9C:00:73:FF:1B:D7:1B:E5:6C:2B:88:EE:55:C7:03:3B","sha256":"6D:B2:1F:62:28:49:76:AE:FC:C1:3A:19:51:4A:60:EB:32:53:AB:10:7C:F2:E8:8F:BD:94:F2:5A:AF:CE:04:04"}}},"request":{"raw":"GET /rsrc.php/ys/r/sAUxDo4kERf.webp HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://p.91syun.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: image/webp\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: bXa0IpZ+8nfB85Rn9lE/xw==\r\nexpires: Sat, 04 Sep 2027 23:40:57 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: dfjuP7tt2k16hdO3pTCMH+RLC9+uPcc6BvUYasjHvWFNd1ytfVRR3SANiEWy/QLXgyBwBIiF21Gl4Zg06ECmyA==\r\ncontent-length: 8364\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=28636, tp=33, tpl=0, uplat=3, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=6,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8364,"size_decoded":10281,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6d76b422967ef277c1f39467f6513fc7","sha1":"534f7df3aa1f42a2a942a29048f6db76110bb2ae","sha256":"bd7942592c7afffb3834958e0432c360813bc81f931a2b4835a8c68fd8010085","sha512":"204565eebbea6be6458a6fd841c984b8a40b07200270e8431844dd78d8afddaf6dc536ba7e1df4183b9cd5eb0d099234842c99b09a38a749e32e5462f499636e","ssdeep":"192:Fl51JIGLVopzuiEszZCW7Hzfw2wTnBSneWwYygSpa:FrIGLV4zdEGZCkzfw2EBSej2ma","tlshash":"5202c00541a8f6f8e760acf41617539d7021b7c9ddae5b689e6e004629be3ccd3da060","first_seen":"2026-08-31T14:46:54.351254Z","last_seen":"2026-09-07T09:12:17.402799Z","times_seen":4,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":13,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"p.91syun.com/extdomains/mbasic.facebook.com/favicon.ico","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.340Z","timestamp":1788772302340,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"p.91syun.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 16:07:03 GMT","end":"Thu, 29 Oct 2026 16:07:02 GMT"},"fingerprint":{"sha1":"10:68:1A:3B:05:11:A4:F7:A8:E9:A7:7A:90:C0:97:A0:C3:73:D4:4D","sha256":"4B:29:43:5C:1F:3F:10:15:A6:64:0E:5D:FA:92:3B:D2:90:DF:85:73:B8:08:0C:B8:C4:5A:71:E7:9F:9E:F9:F1"}}},"request":{"raw":"GET /extdomains/mbasic.facebook.com/favicon.ico HTTP/1.1\r\nHost: p.91syun.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: datr=zX-eau5rVDXybjAGghXvUYAI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\ncache-control: private, no-cache, no-store, must-revalidate\r\nexpires: Sat, 01 Jan 2000 00:00:00 GMT\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-header-req-time: 0.1452\r\nx-powered-by: zmirror/0.29.4\r\nset-cookie: fr=0ZmnD7RDmqUek8XIE..Bqnn_O..AAA.0.0.Bqnn_O.AWfV45Qcbo_la5HP1PRvWMAdyrI; expires=Sun, 06-Dec-2026 09:11:42 GMT; Max-Age=7776000; path=/; domain=p.91syun.com; secure; httponly; SameSite=None\r\ncontent-type: image/png\r\nserver: Apache/2.4.57 (Ubuntu)\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"fr","value":"0ZmnD7RDmqUek8XIE..Bqnn_O..AAA.0.0.Bqnn_O.AWfV45Qcbo_la5HP1PRvWMAdyrI","quoted":false,"path":"/","domain":"p.91syun.com","expires":"2026-12-06T09:11:42Z","raw_expires":"Sun, 06-Dec-2026 09:11:42 GMT","max_age":7776000,"secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"fr=0ZmnD7RDmqUek8XIE..Bqnn_O..AAA.0.0.Bqnn_O.AWfV45Qcbo_la5HP1PRvWMAdyrI; expires=Sun, 06-Dec-2026 09:11:42 GMT; Max-Age=7776000; path=/; domain=p.91syun.com; secure; httponly; SameSite=None"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.57","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":20366,"size_decoded":20889,"mime_type":"image/png","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"b68f6a53572803fc0845856e65ba6b11","sha1":"4b8ae79b4874c5aa89acacf8667e94fce89dec65","sha256":"8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80","sha512":"9d194cba9e8225a66a520b614be53ab6e7020fd4a6ca7ceadd5d4f5b2a98ae8aa52af45a497633e2a59e57ca541a5f030d46db60f43cbe23e63bdc302e68e20e","ssdeep":"48:Xfq3OqXAzh4jaJV9HxG8LaSmO6IgbExw1Xw8JomVn+jwn7:CcwaJViU6IgbEy1AO+jwn7","tlshash":"5692245132430308f45d06b0c647b15a7bed7c832c675e67e9ab3a4e6ff825890275e3","first_seen":"2025-02-20T18:41:00.089582Z","last_seen":"2026-09-07T11:36:04.829833Z","times_seen":21869,"resource_available":false,"data":null}},"time_used":767,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":767,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"p.91syun.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-07T09:11:41.248Z","timestamp":1788772301248,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"p.91syun.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 16:07:03 GMT","end":"Thu, 29 Oct 2026 16:07:02 GMT"},"fingerprint":{"sha1":"10:68:1A:3B:05:11:A4:F7:A8:E9:A7:7A:90:C0:97:A0:C3:73:D4:4D","sha256":"4B:29:43:5C:1F:3F:10:15:A6:64:0E:5D:FA:92:3B:D2:90:DF:85:73:B8:08:0C:B8:C4:5A:71:E7:9F:9E:F9:F1"}}},"request":{"raw":"GET /extdomains/mbasic.facebook.com/login?_fb_noscript=1 HTTP/1.1\r\nHost: p.91syun.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\ncache-control: private, no-cache, no-store, must-revalidate\r\nexpires: Sat, 01 Jan 2000 00:00:00 GMT\r\ndate: Mon, 07 Sep 2026 09:11:41 GMT\r\nx-header-req-time: 0.2259\r\nx-body-req-time: 0.0069\r\nx-compute-time: 0.0093\r\nx-powered-by: zmirror/0.29.4\r\nset-cookie: datr=zX-eau5rVDXybjAGghXvUYAI; expires=Tue, 12-Oct-2027 09:11:41 GMT; Max-Age=34560000; path=/; domain=p.91syun.com; secure; httponly; SameSite=None\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\nserver: Apache/2.4.57 (Ubuntu)\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"datr","value":"zX-eau5rVDXybjAGghXvUYAI","quoted":false,"path":"/","domain":"p.91syun.com","expires":"2027-10-12T09:11:41Z","raw_expires":"Tue, 12-Oct-2027 09:11:41 GMT","max_age":34560000,"secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"datr=zX-eau5rVDXybjAGghXvUYAI; expires=Tue, 12-Oct-2027 09:11:41 GMT; Max-Age=34560000; path=/; domain=p.91syun.com; secure; httponly; SameSite=None"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.57","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5542,"size_decoded":2710,"mime_type":"text/html; charset=utf-8","magic":"XML 1.0 document, ASCII text, with very long lines (3229)","md5":"09c92996ab86e3817b02abd44d69397e","sha1":"a4d7ac85fa46ad4dcd7664f4a75ebe4f7682a7df","sha256":"dd52892b37d70fa9cf39a4bcdce54a428faf3854c304b4e7ba7eab880fa0b8ea","sha512":"24be1e4377eea22ba1c5a98540eff8c379fd46266d998b71cbe6893f925363d87370a8d0ac807be8cc34fa7920b6e1fcba980a2f88905680e89b89e45d679ee2","ssdeep":"96:iwwmff8xeUz2tCSZiYxn7+yngKJy9/h+417JUOdF24n03OdF5uIOdFWW6Rz:iwDImtzB7+d5+4lUOdwyGOdfpOdx0","tlshash":"a4b1c8219280742aa43b89a1f1917bdc7161410fc7a30a29fd365272e7cb9b5a6173dc","first_seen":"2026-09-07T09:12:17.404271Z","last_seen":"2026-09-07T09:12:17.404271Z","times_seen":1,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"p.91syun.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/yN/r/Gjnonzr2XE5.webp","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.006Z","timestamp":1788772302006,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 16 Jun 2026 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"5E:E4:F6:C6:9C:00:73:FF:1B:D7:1B:E5:6C:2B:88:EE:55:C7:03:3B","sha256":"6D:B2:1F:62:28:49:76:AE:FC:C1:3A:19:51:4A:60:EB:32:53:AB:10:7C:F2:E8:8F:BD:94:F2:5A:AF:CE:04:04"}}},"request":{"raw":"GET /rsrc.php/yN/r/Gjnonzr2XE5.webp HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://p.91syun.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: image/webp\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: w/PBwTF6VwVudC20EuTGYQ==\r\nexpires: Sat, 28 Aug 2027 01:43:54 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: ltaQ+DoVI2MRumKMpHgJZfbRZfiHdEutjEvdEWo343jNpZdAtKhebUz7ZmCyVEas8cC96+/0CH4W8ErBRPjSWw==\r\ncontent-length: 212\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=28060, tp=31, tpl=0, uplat=3, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=6,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":212,"size_decoded":2128,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 20x20, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c3f3c1c1317a57056e742db412e4c661","sha1":"60233c17876b845dd2b46ee4e5d91ad993a7fd33","sha256":"e54b17a7c9d9988c4b5df99c0785a7db3c617dc1825c6a8cf87a1f31ad044dcc","sha512":"8d52d877a25fc5d67d43daac7383233bd48745612018aaee88fed4a169303d952d468553a36651e4825a09ba3359aab82d7984e9366ab47e123ff9ab82fdf894","ssdeep":"","tlshash":"b3d02346948481179f473f3507e2551c794c185040f9d274cf8dc8a9045b045351ba4c","first_seen":"2026-08-31T14:46:54.354965Z","last_seen":"2026-09-07T09:12:17.406227Z","times_seen":4,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":6,"connect":20,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/yl/r/HZu_q4UgpFa.webp","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.007Z","timestamp":1788772302007,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 16 Jun 2026 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"5E:E4:F6:C6:9C:00:73:FF:1B:D7:1B:E5:6C:2B:88:EE:55:C7:03:3B","sha256":"6D:B2:1F:62:28:49:76:AE:FC:C1:3A:19:51:4A:60:EB:32:53:AB:10:7C:F2:E8:8F:BD:94:F2:5A:AF:CE:04:04"}}},"request":{"raw":"GET /rsrc.php/yl/r/HZu_q4UgpFa.webp HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://p.91syun.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: image/webp\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: XvdAUmRFIIYumRQvBXyhCQ==\r\nexpires: Sun, 29 Aug 2027 02:07:34 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: CSc4w706D0+NvqOyQsWxfWuE1xvhPsAvHk++UlVGzrmwbgzkx/MpmIlxhmYcE2aXbjYWFjq7Cg8kBzffPb2NpA==\r\ncontent-length: 5042\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=5084, tp=9, tpl=0, uplat=0, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=6,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5042,"size_decoded":6957,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5ef74052644520862e99142f057ca109","sha1":"1ae8339b4aa5f3a45bd5f69d4e715607443ceb4d","sha256":"21f6f024240e4efc0f11866df25a9b1ee823d5fc96d8b29cdb68f5079d7a1067","sha512":"927b71d958eaa122f2d20fea6d0453aced880b3debb69f0be9f6c3c99d3b721b56ef189e0e369e686c60fe8a4c5cb9d098158e4ff8b61015ed9e5fed1b5035b3","ssdeep":"96:W59/GC7fFTOyr7y7tQ1jQ0knEaqcyyUy06tHUVXDSxMR0KuGw02qHI7Aqf0/9svy:Y9/F7yJMUVnEaqvEt2+xMxuGw0b8Aqsx","tlshash":"4ba17e8db08084153f4b0fe51df1fe804e62d065f164876c159ca57ea83cc2725a99af","first_seen":"2026-08-31T14:46:54.348015Z","last_seen":"2026-09-07T09:12:17.407249Z","times_seen":4,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.xx.fbcdn.net/rsrc.php/yX/r/-i1A8a_9REe.webp","fqdn":"static.xx.fbcdn.net","domain":"fbcdn.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.013Z","timestamp":1788772302013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 16 Jun 2026 00:00:00 GMT","end":"Mon, 14 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"5E:E4:F6:C6:9C:00:73:FF:1B:D7:1B:E5:6C:2B:88:EE:55:C7:03:3B","sha256":"6D:B2:1F:62:28:49:76:AE:FC:C1:3A:19:51:4A:60:EB:32:53:AB:10:7C:F2:E8:8F:BD:94:F2:5A:AF:CE:04:04"}}},"request":{"raw":"GET /rsrc.php/yX/r/-i1A8a_9REe.webp HTTP/1.1\r\nHost: static.xx.fbcdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://p.91syun.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: image/webp\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: Qt4b2hXKLrzijHHqYPGnvA==\r\nexpires: Sat, 04 Sep 2027 04:57:11 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.xx.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.xx.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: DTwLmnAWoeaY6Ge3Z+p0G7tpDsihU9lYvKFKelHQ6roOJIKWL8Z8LeLKdiDgR86dqu4ypSCzYMFjli/c/Mvn1Q==\r\ncontent-length: 8358\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=10, rtx=0, c=23, mss=1232, tbw=11724, tp=16, tpl=0, uplat=3, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=6,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8358,"size_decoded":10275,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42de1bda15ca2ebce28c71ea60f1a7bc","sha1":"924114b2d3068486539a17f36b24d3ac1fa74512","sha256":"be8612325445c94da0c734d84619746daa93ad2dd41ff21220a1b75601c3ba13","sha512":"8925f543682f33f3e9a50eb09503b839848f16c7d92bc7194a9de16211ecbe6cd34bac351c292273d919e16dabd95425b7c3cf6d1fa8e55bf4834f7059fe7ada","ssdeep":"192:dbMpvjr8+pyyX8VrtFVXxpB06T9XkVOcbqkTwBb8Pr0B95NQKQ8:upDF8XXHS6T9XO/uHr5NQF8","tlshash":"1c029e24119ff63ce97ccc2cb5aa98c81f9da0a774b650d3292a4f314c28781e4fbc50","first_seen":"2026-08-31T14:46:54.349652Z","last_seen":"2026-09-07T09:12:17.407969Z","times_seen":4,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"p.91syun.com/favicon.ico","fqdn":"p.91syun.com","domain":"91syun.com","tld":"com"},"ip":{"addr":"119.28.142.222","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1","date":"2026-09-07T09:11:42.021Z","timestamp":1788772302021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"p.91syun.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 16:07:03 GMT","end":"Thu, 29 Oct 2026 16:07:02 GMT"},"fingerprint":{"sha1":"10:68:1A:3B:05:11:A4:F7:A8:E9:A7:7A:90:C0:97:A0:C3:73:D4:4D","sha256":"4B:29:43:5C:1F:3F:10:15:A6:64:0E:5D:FA:92:3B:D2:90:DF:85:73:B8:08:0C:B8:C4:5A:71:E7:9F:9E:F9:F1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: p.91syun.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://p.91syun.com/extdomains/mbasic.facebook.com/login?_fb_noscript=1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: datr=zX-eau5rVDXybjAGghXvUYAI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 \r\naccess-control-allow-origin: *\r\ncontent-length: 313\r\nlocation: https://p.91syun.com/extdomains/mbasic.facebook.com/favicon.ico\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 07 Sep 2026 09:11:42 GMT\r\nserver: Apache/2.4.57 (Ubuntu)\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.57","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-07T11:14:23.67375Z","times_seen":18328105,"resource_available":true,"data":null}},"time_used":312,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"p.91syun.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"p.91syun.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}