Report - toolsxsocial.in/ff-gems/7dhZbAA6b6

Report Overview

Submitted URL
toolsxsocial.in/ff-gems/7dhZbAA6b6
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-17 16:18:46
Access
public
Website Title
Log in to Facebook | Facebook
Final URL
toolsxsocial.in/ff-gems/7dhZbAA6b6
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
toolsxsocial.in	unknown	2023-12-31	2024-01-01	2024-03-28	2.3 kB	46 kB	188.114.96.1
static.xx.fbcdn.net	661	2007-05-03	2012-12-01	2024-04-16	2.4 kB	49 kB	31.13.72.12

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	toolsxsocial.in/ff-gems/7dhZbAA6b6	Facebook, Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	toolsxsocial.in	Sinkholed
2024-04-17	medium	toolsxsocial.in	Sinkholed
2024-04-17	medium	toolsxsocial.in	Sinkholed
2024-04-17	medium	toolsxsocial.in	Sinkholed
2024-04-17	medium	toolsxsocial.in	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	unknown	247 B	2024-04-17	2024-04-17
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-17 18:18:47 Last Seen2024-04-17 18:18:47 Times Seen1 Hash 9782bf2305b6f6e150af3f9898355bfb d2c2a83770bd7d638293590140588778c44f327b 7de45be7526aeba0e1856329dc72cb646550a86d91c4626458f38f932747ee20 Loading...

	toolsxsocial.in/cdn-cgi/challenge-platform/scripts/jsd/main.js	7.8 kB	2024-04-17	2024-04-17
Pretty URL toolsxsocial.in/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-17 17:37:48 Last Seen2024-04-17 18:18:47 Times Seen6 Hash af9eba7652cffc5b3b0124e94133e950 d62e70e0cc73aaeaff8b4ee1a1c40658a9ea23de ba6fba8a4047170f0832c716b56a6794107b8a04bc9e8996831755a472048400 Loading...

	toolsxsocial.in/ff-gems/7dhZbAA6b6	1.0 kB	2024-04-17	2024-04-17
Pretty URL toolsxsocial.in/ff-gems/7dhZbAA6b6 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-17 18:18:47 Last Seen2024-04-17 18:18:47 Times Seen1 Hash f54e8dcabe3561290f9201289e74fff0 892eb5f33e63be9fe95a1d20c052b39a494a85ca faa1b3da7486f4c89d4d6cce719c079771141758eec97adac144aea5fad34ee8 Loading...

	toolsxsocial.in/ff-gems/7dhZbAA6b6	1.1 kB	2024-04-17	2024-04-17
Pretty URL toolsxsocial.in/ff-gems/7dhZbAA6b6 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-17 18:18:47 Last Seen2024-04-17 18:18:47 Times Seen1 Hash 28a48b72f7a671787f1f594289efb1de 6a6511c4aa0b0d264b3aa2f7cc918013d1211b76 eee093a87be240c5a42c75c0afda090d4b62ce685098e0c8e9852c87da79c93e Loading...

HTTP Transactions (10)

URL IP Response Size

toolsxsocial.in/download.jpeg

188.114.96.1

200 OK

14 kB

URL GET HTTP/3
toolsxsocial.in/download.jpeg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerGoogle Trust Services LLC
Subjecttoolsxsocial.in
Fingerprint97:2B:59:D3:52:48:81:D5:8C:05:03:A6:25:1E:DF:43:DE:6D:D1:64
ValiditySun, 10 Mar 2024 13:25:27 GMT - Sat, 08 Jun 2024 13:25:26 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Size
14 kB (14421 bytes)
Hash
2c1f76576a336d6e1e61874c5dcd8d9c
ff3e987e1581d71f8e2f554fb79ac2eddae1547f
277752ecfa64f5c844b0b23480124260e109c1ed437aabd6467bdf6d7d903b4f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /download.jpeg HTTP/1.1
Host: toolsxsocial.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://toolsxsocial.in/ff-gems/7dhZbAA6b6
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 16:18:21 GMT
content-type: image/jpeg
content-length: 14421
last-modified: Wed, 24 Jan 2024 14:48:04 GMT
etag: "65b12324-3855"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 6063
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gGrKEa%2FFu4rrn2c7h7maBxwCtD0e0teNjQ1esS39CdqlCKxhXMwgxHXNGBKr39%2FHCfqiZfQPpdopY9pFIQDASZQJUkFJOTbZVpsfsBP4pIGT2zO6hYbG5ZcIKbgilOCy8IE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875dbb074a9fbe3a-CPH
alt-svc: h3=":443"; ma=86400

static.xx.fbcdn.net/rsrc.php/v3/yT/l/0,cross/ygkXgVf1DoZ.css?_nc_x=Ij3Wp8lg5Kz

31.13.72.12

200 OK

5.9 kB

URL GET HTTP/2
static.xx.fbcdn.net/rsrc.php/v3/yT/l/0,cross/ygkXgVf1DoZ.css?_nc_x=Ij3Wp8lg5Kz
IP
31.13.72.12:443
ASN
#32934 FACEBOOK

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerDigiCert Inc
Subject*.facebook.com
Fingerprint8B:2F:EA:8C:DA:31:F2:58:FE:76:7C:4A:AB:3C:1F:0A:CD:0F:EF:D1
ValidityFri, 26 Jan 2024 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT

File type
ASCII text, with very long lines (6100)
Size
5.9 kB (5851 bytes)
Hash
4bcc6997a959b3392364b6e7bc97c186
019deff2c306163a24253b338b467ac5b896a2e5
0aa3a997ddd9fd8eee40bbd411bcce0bcb10037ab6f29a60eb26b49b0958041d

HTTP Headers

GET /rsrc.php/v3/yT/l/0,cross/ygkXgVf1DoZ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1
Host: static.xx.fbcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://toolsxsocial.in
DNT: 1
Connection: keep-alive
Referer: https://toolsxsocial.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: br
content-type: text/css; charset=utf-8
access-control-allow-origin: *
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
expires: Sat, 05 Apr 2025 06:29:49 GMT
cache-control: public,max-age=31536000,immutable
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
timing-allow-origin: *
document-policy: force-load-at-top
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-md5: 5gun60A+MDmpCnvGqWVswg==
x-fb-debug: mzXtQK4k1wKJaoxB9pCXU/Qhk7F5zDN26spNBXg711VqTNowWjDpn/keaVfgbBzmZKMXX/g1AvDlgDvKJRVl1A==
content-length: 5851
date: Wed, 17 Apr 2024 16:18:22 GMT
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=3439, tp=-1, tpl=-1, uplat=2, ullat=-1
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/77Hot7ew_hn.css?_nc_x=Ij3Wp8lg5Kz

31.13.72.12

200 OK

11 kB

URL GET HTTP/2
static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/77Hot7ew_hn.css?_nc_x=Ij3Wp8lg5Kz
IP
31.13.72.12:443
ASN
#32934 FACEBOOK

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerDigiCert Inc
Subject*.facebook.com
Fingerprint8B:2F:EA:8C:DA:31:F2:58:FE:76:7C:4A:AB:3C:1F:0A:CD:0F:EF:D1
ValidityFri, 26 Jan 2024 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT

File type
ASCII text, with very long lines (6639)
Size
11 kB (11389 bytes)
Hash
de171a5f6a1843e5234444b819f52043
c399cdb7902c725bcf8ee42e64642f239d876fde
7c2618ca3ea9cb93bab0ee163a28234293fa4948a00cb2576e6a3a3f9735b139

HTTP Headers

GET /rsrc.php/v3/yf/l/0,cross/77Hot7ew_hn.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1
Host: static.xx.fbcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://toolsxsocial.in
DNT: 1
Connection: keep-alive
Referer: https://toolsxsocial.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: br
content-type: text/css; charset=utf-8
access-control-allow-origin: *
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
expires: Sat, 05 Apr 2025 06:29:49 GMT
cache-control: public,max-age=31536000,immutable
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
timing-allow-origin: *
document-policy: force-load-at-top
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-md5: eZ9leNHwGGub0hF8NvWUPA==
x-fb-debug: BGS+dVIArQ1Ny2Q0yoOnKdR1dNwNikPZHN/5Wt6B27pUrkB5dT0GolTvxvBbu3gwpAN7kHEi03eAWxW2p+1dUQ==
content-length: 11389
date: Wed, 17 Apr 2024 16:18:22 GMT
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=10596, tp=-1, tpl=-1, uplat=2, ullat=-1
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

static.xx.fbcdn.net/rsrc.php/v3/yZ/r/K804LXnHlWj.png

31.13.72.12

200 OK

10 kB

URL GET HTTP/2
static.xx.fbcdn.net/rsrc.php/v3/yZ/r/K804LXnHlWj.png
IP
31.13.72.12:443
ASN
#32934 FACEBOOK

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerDigiCert Inc
Subject*.facebook.com
Fingerprint8B:2F:EA:8C:DA:31:F2:58:FE:76:7C:4A:AB:3C:1F:0A:CD:0F:EF:D1
ValidityFri, 26 Jan 2024 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT

File type
PNG image data, 309 x 204, 8-bit colormap, non-interlaced
Size
10 kB (10001 bytes)
Hash
403d297b370bcb1d07e5a559e2c2a48e
aa70ffaeca77b55fdfe08f66166cc50e21d19296
232dcc98c74e41dd0d95aee456020689ab6de77aae93d5102f0b50d8d1ec84b5

HTTP Headers

GET /rsrc.php/v3/yZ/r/K804LXnHlWj.png HTTP/1.1
Host: static.xx.fbcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/77Hot7ew_hn.css?_nc_x=Ij3Wp8lg5Kz
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
access-control-allow-origin: *
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: QD0pezcLyx0H5aVZ4sKkjg==
expires: Sun, 06 Apr 2025 04:18:43 GMT
cache-control: public,max-age=31536000,immutable
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
timing-allow-origin: *
document-policy: force-load-at-top
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
origin-agent-cluster: ?0
x-fb-debug: Xf54wEhopeaHMxK7/EHm4PcoAdaubEgeMjmdGZzqzfVHjE4NU1lByNfu/KUTtv+yTCyXV0m16z3vOtYUwLTc0A==
content-length: 10001
date: Wed, 17 Apr 2024 16:18:22 GMT
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=34, mss=1380, tbw=22330, tp=-1, tpl=-1, uplat=1, ullat=-1
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

static.xx.fbcdn.net/rsrc.php/v3/yj/r/gB76kJXPYJV.png

31.13.72.12

200 OK

6.7 kB

URL GET HTTP/3
static.xx.fbcdn.net/rsrc.php/v3/yj/r/gB76kJXPYJV.png
IP
31.13.72.12:443
ASN
#32934 FACEBOOK

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerDigiCert Inc
Subject*.facebook.com
Fingerprint8B:2F:EA:8C:DA:31:F2:58:FE:76:7C:4A:AB:3C:1F:0A:CD:0F:EF:D1
ValidityFri, 26 Jan 2024 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT

File type
PNG image data, 196 x 196, 8-bit colormap, non-interlaced
Size
6.7 kB (6690 bytes)
Hash
389dfa18be34d8cf767e06fd5cde4ec6
47b751cffab47d076816c63ce08d3e84600376ee
3c45ce612f41b1e7936e7cf5b235047344fd3146d1630e342f186d1d1e8e00d5

HTTP Headers

GET /rsrc.php/v3/yj/r/gB76kJXPYJV.png HTTP/1.1
Host: static.xx.fbcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://toolsxsocial.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: image/png
access-control-allow-origin: *
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OJ36GL402M92fgb9XN5Oxg==
expires: Fri, 04 Apr 2025 03:08:05 GMT
cache-control: public,max-age=31536000,immutable
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
timing-allow-origin: *
document-policy: force-load-at-top
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
origin-agent-cluster: ?0
x-fb-debug: QMGjKhWHlNrj1Ht5M9mxYO/5zpOEt0LuyazulnY4ASkcln96FNztaBlaCDnKoHqVAd1PHMZoHKu2x2YIL7C7rA==
content-length: 6690
date: Wed, 17 Apr 2024 16:18:22 GMT
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=39, mss=1232, tbw=5140, tp=10, tpl=0, uplat=0, ullat=-1
alt-svc: h3=":443"; ma=86400
priority: u=6

static.xx.fbcdn.net/rsrc.php/v3/yj/r/gB76kJXPYJV.png

31.13.72.12

200 OK

6.7 kB

URL GET HTTP/3
static.xx.fbcdn.net/rsrc.php/v3/yj/r/gB76kJXPYJV.png
IP
31.13.72.12:443
ASN
#32934 FACEBOOK

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerDigiCert Inc
Subject*.facebook.com
Fingerprint8B:2F:EA:8C:DA:31:F2:58:FE:76:7C:4A:AB:3C:1F:0A:CD:0F:EF:D1
ValidityFri, 26 Jan 2024 00:00:00 GMT - Thu, 25 Apr 2024 23:59:59 GMT

File type
PNG image data, 196 x 196, 8-bit colormap, non-interlaced
Size
6.7 kB (6690 bytes)
Hash
389dfa18be34d8cf767e06fd5cde4ec6
47b751cffab47d076816c63ce08d3e84600376ee
3c45ce612f41b1e7936e7cf5b235047344fd3146d1630e342f186d1d1e8e00d5

HTTP Headers

GET /rsrc.php/v3/yj/r/gB76kJXPYJV.png HTTP/1.1
Host: static.xx.fbcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://toolsxsocial.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: image/png
access-control-allow-origin: *
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OJ36GL402M92fgb9XN5Oxg==
expires: Fri, 04 Apr 2025 03:08:05 GMT
cache-control: public,max-age=31536000,immutable
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
timing-allow-origin: *
document-policy: force-load-at-top
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
origin-agent-cluster: ?0
x-fb-debug: QMGjKhWHlNrj1Ht5M9mxYO/5zpOEt0LuyazulnY4ASkcln96FNztaBlaCDnKoHqVAd1PHMZoHKu2x2YIL7C7rA==
content-length: 6690
date: Wed, 17 Apr 2024 16:18:22 GMT
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=39, mss=1232, tbw=13188, tp=17, tpl=0, uplat=0, ullat=-1
alt-svc: h3=":443"; ma=86400
priority: u=6

toolsxsocial.in/cdn-cgi/challenge-platform/scripts/jsd/main.js

188.114.96.1

302 Found

0 B

URL GET HTTP/3
toolsxsocial.in/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerGoogle Trust Services LLC
Subjecttoolsxsocial.in
Fingerprint97:2B:59:D3:52:48:81:D5:8C:05:03:A6:25:1E:DF:43:DE:6D:D1:64
ValiditySun, 10 Mar 2024 13:25:27 GMT - Sat, 08 Jun 2024 13:25:26 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: toolsxsocial.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 302 Found
date: Wed, 17 Apr 2024 16:18:22 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Be7tUxDLwqRuJEt0dboYWreGzFjnfd%2FjX5dMRQuNzqivt7XSN76nREB32W3dS3frcirhsomKvjG1d5UPKtekERz2EZikUGzSkPlsuEBuPu5kEG%2Fj0EbivdMdjlzA2WJe6Hw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875dbb08ad93be3a-CPH
alt-svc: h3=":443"; ma=86400

toolsxsocial.in/cdn-cgi/challenge-platform/h/g/jsd/r/875dbb057a80930a

188.114.96.1

200 OK

7.5 kB

URL POST HTTP/3
toolsxsocial.in/cdn-cgi/challenge-platform/h/g/jsd/r/875dbb057a80930a
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerGoogle Trust Services LLC
Subjecttoolsxsocial.in
Fingerprint97:2B:59:D3:52:48:81:D5:8C:05:03:A6:25:1E:DF:43:DE:6D:D1:64
ValiditySun, 10 Mar 2024 13:25:27 GMT - Sat, 08 Jun 2024 13:25:26 GMT

File type
data
Size
7.5 kB (7503 bytes)
Hash
356d3ffeb4bbee9d41ce53d3ee74ff02
eee0f43f5386c41e7fc3dbbb46f1ba19a5ae2d87
5a650435e78be9cdf277fe04f870205c6ea12938c8457d6bc4cd11f625c0b869

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/jsd/r/875dbb057a80930a HTTP/1.1
Host: toolsxsocial.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12182
Origin: https://toolsxsocial.in
DNT: 1
Connection: keep-alive
Referer: https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 16:18:22 GMT
content-type: text/plain; charset=UTF-8
set-cookie: cf_clearance=qnG9TjQs.YuG5ABUbVf7ueezF6oT_6qdjsZa8LmtlK0-1713370702-1.0.1.1-McfNWEGsN3oybLYOUbIXgUL36T7X2VBe99sO4QiHpiE_Zv63eMr09ro6t_ZbnvHCzTa1k.Yei9uo4lG7agPDzw; path=/; expires=Thu, 17-Apr-25 16:18:22 GMT; domain=.toolsxsocial.in; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Db0kxbRPa5sbdYDMTt9kAnGJqBaY7Oz8gSd%2FqJY6EFe0J0Iq%2BM%2F5VRwdaIPuEVNvvOseedoU7n%2BxTnhPexWsLjWIrSd2IYE223wW4a8lhQQ6cEF1SuH5rH0R9f5VyBV8e58%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 875dbb0a0840be3a-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400

toolsxsocial.in/ff-gems/7dhZbAA6b6

188.114.96.1

200 OK

12 kB

URL User Request GET HTTP/2
toolsxsocial.in/ff-gems/7dhZbAA6b6
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjecttoolsxsocial.in
Fingerprint97:2B:59:D3:52:48:81:D5:8C:05:03:A6:25:1E:DF:43:DE:6D:D1:64
ValiditySun, 10 Mar 2024 13:25:27 GMT - Sat, 08 Jun 2024 13:25:26 GMT

File type

Size
12 kB (12384 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Facebook, Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /ff-gems/7dhZbAA6b6 HTTP/1.1
Host: toolsxsocial.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 17 Apr 2024 16:18:21 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=3600
cf-cache-status: HIT
age: 6362
last-modified: Wed, 17 Apr 2024 14:32:19 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0pkHqRfWUSGu92%2BETwo%2BhJn1B89sx8LI%2FMZM4H%2FLG%2FFTXEbQNMv8xYiDGyiwYHILnVgCgjHZ%2FbWCPXDBxlNTqHE8rJKJtnCRKfP0kZ7AMGjtcdgvaSmj2VjVpb4T%2FbHZio%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 875dbb057a80930a-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

toolsxsocial.in/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js

188.114.96.1

200 OK

7.8 kB

URL GET HTTP/3
toolsxsocial.in/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://toolsxsocial.in/ff-gems/7dhZbAA6b6
Certificate
IssuerGoogle Trust Services LLC
Subjecttoolsxsocial.in
Fingerprint97:2B:59:D3:52:48:81:D5:8C:05:03:A6:25:1E:DF:43:DE:6D:D1:64
ValiditySun, 10 Mar 2024 13:25:27 GMT - Sat, 08 Jun 2024 13:25:26 GMT

File type
JavaScript source, ASCII text, with very long lines (7823), with no line terminators
Size
7.8 kB (7823 bytes)
Hash
af9eba7652cffc5b3b0124e94133e950
d62e70e0cc73aaeaff8b4ee1a1c40658a9ea23de
ba6fba8a4047170f0832c716b56a6794107b8a04bc9e8996831755a472048400

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js HTTP/1.1
Host: toolsxsocial.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 17 Apr 2024 16:18:22 GMT
content-type: application/javascript; charset=UTF-8
vary: accept-encoding
x-content-type-options: nosniff
content-encoding: br
cache-control: max-age=14400, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SS9LkesZFUDVDkg5QwOnUxXIbBZogFicE32pq1hzGGn%2BAwvHoUhcEMrPxsahx9EqAq3r4L%2F7Mf0v3gAJ8xi9j2Tp3sFMoFFOqKIQi9TwIt3ClIcQ%2FBLr0UaaA1kLdVpyp7g%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 875dbb08fe32be3a-CPH
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers