{"report_id":"261ed480-3a7d-4460-828c-f469d02b9209","version":6,"status":"done","tags":[],"date":"2026-03-04T19:09:40Z","url":{"schema":"https","addr":"tenzot.icu","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":0,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"title":"Security Check","dom":{"size":105080,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (58141)","md5":"3b2a5104cecf2fc5504f7219e52afdf4","sha1":"384671150f726eec6605dc40da8d1fd8812ef0be","sha256":"1aa8539edfdb60f0d297d0192ad142f5d1e8ae264b470032b9c5268337316723","sha512":"96b305542b80a206581b5485ba2d37c5d69c70004c5d05d6dd35f991e7c76eb166c9e1f7fedbdec825369bba375f7d843c545ea988d31a69a97e6246427f1b86","ssdeep":"1536:dfXW+d4BO2rT205sXwhbsPzB8T9IkOinOtiI7tblZ9ciNiDUiDe8bVEP95NrX3I3:RFd4E2/+AiPz+TSYOUO4ioBeysdmeW","tlshash":"4da3f136b456243fec4bd31fb4fdea4f3820480395035819d6ad2a998b99f05177dbac","dom_hash":"domhash69efb32501f0eae3f4d0119aed69f153","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tenzot.icu","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":0,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T19:09:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-04T19:09:19Z","timestamp":1772651359,"ip_dst":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"ip_src":{"addr":"Client IP","port":55414,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-03-04T19:09:19.481738+0000\",\"flow_id\":1475752967007648,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.51\",\"src_port\":55414,\"dest_ip\":\"95.182.116.28\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"tenzot.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1554,\"start\":\"2026-03-04T19:09:19.322976+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"tenzot.icu","ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"domain_registered":"2026-02-27","domain_rank":0,"first_seen":"2026-03-04T19:09:40.432653Z","last_seen":"2026-03-04T19:09:40.432653Z","alert_count":0,"request_count":4,"received_data":120130,"sent_data":2154,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"0252468e64df9fd8972b9476234468ef","sha1":"859d364f9b42fbbd93e94d9dfb5ee284512e4bab","sha256":"8049333166f0e0d5248288927708258cbb695843baae06d0543182300fea81b3","sha512":"c9560b5d85bd37212457e80ebed61dec08a03fa945bf4d532d4007b13e792d55344d2c47e1e515c72cdc6490407c58d65c1fefd5aa0c2d4ddb92ccd4603d3f15","ssdeep":"96:IGGM6N1inrR60foL1Wf+w1qx1JLnCBYknH+HhNQekq0wRA7e+Uqz84rKPNH:7FVp12pnCKknE6pkqBrKVH","tlshash":"51b1b4f23496243f0cba527f157fa34d3d7218265c0b8504ccaca86c6e74d8625bafad","size":5247,"data":"","first_seen":"2026-03-04T19:09:44.25938Z","last_seen":"2026-03-04T19:09:44.25938Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tenzot.icu/","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T19:09:18.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tenzot.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 18:44:23 GMT","end":"Thu, 28 May 2026 18:44:22 GMT"},"fingerprint":{"sha1":"1D:F0:7F:C1:9C:2F:22:79:13:2E:B1:67:11:8D:DE:C1:71:FC:87:F2","sha256":"D1:DA:95:97:09:15:B5:6F:3D:DD:88:86:21:47:B7:3D:39:C8:8D:04:5E:EA:0A:96:83:73:DC:59:A4:70:CB:75"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tenzot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:09:19 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 148\r\nConnection: keep-alive\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nExpires: 0\r\nLocation: /.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3\r\nPermissions-Policy: geolocation=(), microphone=(), camera=()\r\nPragma: no-cache\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13311,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T17:42:21.256573Z","times_seen":17532132,"resource_available":true,"data":null}},"time_used":1289,"timings":{"blocked":516,"dns":360,"connect":33,"send":0,"wait":251,"receive":0,"ssl":126},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T19:09:19.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tenzot.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 18:44:23 GMT","end":"Thu, 28 May 2026 18:44:22 GMT"},"fingerprint":{"sha1":"1D:F0:7F:C1:9C:2F:22:79:13:2E:B1:67:11:8D:DE:C1:71:FC:87:F2","sha256":"D1:DA:95:97:09:15:B5:6F:3D:DD:88:86:21:47:B7:3D:39:C8:8D:04:5E:EA:0A:96:83:73:DC:59:A4:70:CB:75"}}},"request":{"raw":"GET /.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3 HTTP/1.1\r\nHost: tenzot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:09:19 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nExpires: 0\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":13311,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (354)","md5":"080e647bcd97a4719e3bbc7281f0a8ae","sha1":"74f7da099bc6950447e39e3b9e74de5b5565534c","sha256":"572d5e18e314917c2b0d0516201f3093a0fb09194616e970d24b5035029d7087","sha512":"b3f75e52196cbd62e08f889b0a71d2fb2fd81eeeeb7e0aee03e5ce336c294bd9349ee82fee367ea688adea9a29432eb1a3ed03c04da7987f5b25ace8e07055eb","ssdeep":"192:8sLQRxLD9Z1aCOFEbFdb62IyaflGlwYk45h9s/AbFOrFVp12pnCKknE6pkqBrKVW:zgyQbFdun1flOwhSlErNYWVpnrmW","tlshash":"df521ab22541203fa433c1ab6af5e74e34758803e913490deaed729dcf559cf25b9b88","first_seen":"2026-03-04T19:09:44.257187Z","last_seen":"2026-03-04T19:09:44.257187Z","times_seen":1,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tenzot.icu/.merc/captcha/generate?type=click_shape\u0026dots=3\u0026ct=ea4a1d6eb7c89bf8","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3","date":"2026-03-04T19:09:20.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tenzot.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 18:44:23 GMT","end":"Thu, 28 May 2026 18:44:22 GMT"},"fingerprint":{"sha1":"1D:F0:7F:C1:9C:2F:22:79:13:2E:B1:67:11:8D:DE:C1:71:FC:87:F2","sha256":"D1:DA:95:97:09:15:B5:6F:3D:DD:88:86:21:47:B7:3D:39:C8:8D:04:5E:EA:0A:96:83:73:DC:59:A4:70:CB:75"}}},"request":{"raw":"GET /.merc/captcha/generate?type=click_shape\u0026dots=3\u0026ct=ea4a1d6eb7c89bf8 HTTP/1.1\r\nHost: tenzot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:09:20 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":91937,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c3ef2ea40f7f689ec328b36700c1bd99","sha1":"bc881efa15c816f3c33085e07e96c34f1eecdf34","sha256":"fe2d84a4cd47157bc99aeec22a6d2a705834468ed7748f611b503c4bcae17e77","sha512":"35cc0b1b66a258190e16f7ed72e8a02bc3e08aa7f7aae2e100e0c2172f999b19a8c7f8f137f8bf42c13594f87d6293ce494618fd5cfdd33bed58dade9ec4fe0a","ssdeep":"1536:xW+d4BO2rT205sXwhbsPzB8T9IkOinOtiI7tblZ9ciNiDUiDe8bVEP95NrX3IpN:xFd4E2/+AiPz+TSYOUO4ioBeysdmN","tlshash":"3193022ef86bb9bbdc8f9b0ff4aeac475d00590601076875962d2e95429af20071db7c","first_seen":"2026-03-04T19:09:44.25849Z","last_seen":"2026-03-04T19:09:44.25849Z","times_seen":1,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":183,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tenzot.icu/favicon.ico","fqdn":"tenzot.icu","domain":"tenzot.icu","tld":"icu"},"ip":{"addr":"95.182.116.28","port":443,"asn":48780,"as":"Oltelecom Jsc","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3","date":"2026-03-04T19:09:20.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tenzot.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 18:44:23 GMT","end":"Thu, 28 May 2026 18:44:22 GMT"},"fingerprint":{"sha1":"1D:F0:7F:C1:9C:2F:22:79:13:2E:B1:67:11:8D:DE:C1:71:FC:87:F2","sha256":"D1:DA:95:97:09:15:B5:6F:3D:DD:88:86:21:47:B7:3D:39:C8:8D:04:5E:EA:0A:96:83:73:DC:59:A4:70:CB:75"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: tenzot.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://tenzot.icu/.merc/captcha?return_url=%2F\u0026score=13\u0026reason=suspicious_rdns\u0026type=click_shape\u0026ct=ea4a1d6eb7c89bf8\u0026dots=3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: openresty/1.27.1.2\r\nDate: Wed, 04 Mar 2026 19:09:20 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nEtag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nPermissions-Policy: geolocation=(), microphone=(), camera=()\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"OpenResty:1.27.1.2","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T17:42:21.256573Z","times_seen":17532132,"resource_available":true,"data":null}},"time_used":360,"timings":{"blocked":0,"dns":1,"connect":33,"send":0,"wait":179,"receive":0,"ssl":147},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}