{"report_id":"bf3a17ce-7eef-42ef-b9dd-12884ba43191","version":6,"status":"done","tags":[],"date":"2026-02-01T18:44:11Z","url":{"schema":"https","addr":"opp-portal.info/","fqdn":"opp-portal.info","domain":"opp-portal.info","tld":"info"},"ip":{"addr":"207.174.61.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"opp-portal.info/","fqdn":"opp-portal.info","domain":"opp-portal.info","tld":"info"},"title":"opp-portal.info is a custom short domain","dom":{"size":4933,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (781)","md5":"97a02ac36c9b712a18970a58f2038b9e","sha1":"535b289d42ff5807287c282342c5355362345f1c","sha256":"54ceed46178f42b4aa04acdaa637a75b4d7e2b51b58d81993d80911ae574a7e8","sha512":"cb602a5a0252b9af0cc780d060bc716f9144b08dda1757b0e840fef646307ecb1db1fab7b07dce4bea310d069e1f4c9d9cc334269d8da40705d12278f68b5c79","ssdeep":"96:+dr0YWaIecI7VtUyQzbrcUrWST0derl/BlY3kclY3kSw0JNRz89FA:+dwYWabcI7VtUySbgUlTUe1BW3kcW3km","tlshash":"15a1936662a352027a9380706fe637049161c013c909deb8becd928dcfc81e9b9f33cd","dom_hash":"domhashf2312a91ade50b079f7c69ffd0336d18","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"opp-portal.info/","fqdn":"opp-portal.info","domain":"opp-portal.info","tld":"info"},"ip":{"addr":"207.174.61.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T18:44:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"opp-portal.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"d2te5kruq0pvbl.cloudfront.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"opp-portal.info","ip":{"addr":"91.197.243.143","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-01T01:53:58.444929Z","last_seen":"2026-02-01T01:53:58.444929Z","alert_count":1,"request_count":1,"received_data":5342,"sent_data":484,"comment":"","tags":null,"fingerprints":null},{"fqdn":"d2te5kruq0pvbl.cloudfront.net","ip":{"addr":"52.84.50.71","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2008-04-25","domain_rank":0,"first_seen":"2016-06-26T14:23:52Z","last_seen":"2026-02-01T17:25:44.36472Z","alert_count":1,"request_count":1,"received_data":272414,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"opp-portal.info/","fqdn":"opp-portal.info","domain":"opp-portal.info","tld":"info"},"ip":{"addr":"91.197.243.143","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T18:43:49.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"opp-service.info","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 09:37:44 GMT","end":"Sat, 25 Apr 2026 09:37:43 GMT"},"fingerprint":{"sha1":"49:FE:F5:92:CE:EA:4C:E4:7E:BC:0D:9F:10:94:FE:37:CE:D4:7E:F9","sha256":"93:89:BC:AB:49:76:85:48:A7:C3:28:01:09:59:A8:EB:EC:C5:20:0C:6B:B0:DB:94:37:B2:4E:69:D5:39:89:FE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: opp-portal.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-powered-by: Short.io/Edge\r\nx-robots-tag: none\r\ncontent-length: 1714\r\ndate: Sun, 01 Feb 2026 18:43:49 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5077,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (781)","md5":"002134c6b52517e15c31988643592ccf","sha1":"66cbef381d730392ba1b7a7023830d3868be36d3","sha256":"871b9059e85e25c1ed30adda7386ed2d1eec401fcefff2e2565f87e45d6c7444","sha512":"072e340913ce471c1ddd23d54f22a0071db49c207e4c00a427254e500707dcc3b85428c2b3867bd262f81de2296b94c0252468a33cbc5113fc683193790182c3","ssdeep":"96:2sr0YWaIecI7VtUyQzbrcUrWST0derl/BlY3kclY3kSw0JNWz89FPu:2swYWabcI7VtUySbgUlTUe1BW3kcW3k3","tlshash":"52a1955a62a352427a9380746fd637449161c013c909deb8becd924dcfc81e8b9f33dd","first_seen":"2026-02-01T01:54:02.540773Z","last_seen":"2026-02-01T18:44:12.947281Z","times_seen":2,"resource_available":false,"data":null}},"time_used":462,"timings":{"blocked":168,"dns":64,"connect":1,"send":0,"wait":121,"receive":0,"ssl":106},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"opp-portal.info","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"d2te5kruq0pvbl.cloudfront.net/redirector/branded_short_domain.png","fqdn":"d2te5kruq0pvbl.cloudfront.net","domain":"d2te5kruq0pvbl.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"52.84.50.71","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://opp-portal.info/","date":"2026-02-01T18:43:50.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cloudfront.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 05 May 2025 00:00:00 GMT","end":"Thu, 23 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:00:F1:34:A7:1E:27:1C:CF:CD:A6:53:8B:C4:82:B0:68:BC:C8:72","sha256":"60:38:9D:24:9E:41:8F:23:AC:D9:14:5C:A3:47:7E:AF:07:DB:9F:2D:6A:8C:0D:08:E9:24:8A:8E:49:A9:4D:28"}}},"request":{"raw":"GET /redirector/branded_short_domain.png HTTP/1.1\r\nHost: d2te5kruq0pvbl.cloudfront.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://opp-portal.info/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 271832\r\nlast-modified: Mon, 21 Aug 2023 10:33:06 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: null\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Sun, 01 Feb 2026 07:20:31 GMT\r\netag: \"8d436d5e399758322b1f485396fbc8dd\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 2f3a70deb5812eb0e48215ada7b72404.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-amz-cf-id: HtPKXelEKNIgw6E3-pQUsx2B3tqs0jPiaSU5e0pU8gpGpxbNuhSwkg==\r\nage: 41000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":271832,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 926 x 694, 8-bit/color RGBA, non-interlaced","md5":"8d436d5e399758322b1f485396fbc8dd","sha1":"b2fd928bdbcd7e8ebd2abd371cfbf1df469e2230","sha256":"ddb9b11ee289b45669a9ef05956c6735fc08b73c4021b22ceba440174dba3c33","sha512":"1d2af29d84dc49eb6ea34b9413c7c0aa33ef3841087209df4b4d51e515758e01d39d65e701176ded9894bfddee065665b8c9575574544410d290cc13990dbb31","ssdeep":"6144:kbPzKuMafkOM3ipViCUpZrKbbd9AsQuniE9vN7v2ZIt5r3Ijdy:kjzwafxCipViZpZKd9rQ29lT95EI","tlshash":"ce44231a800044cdc8bd7432ff21bfd4d6a699f165461d28ed2af360c54e32bde75c9a","first_seen":"2023-05-15T15:51:09Z","last_seen":"2026-04-06T07:47:25.25693Z","times_seen":598,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":40,"dns":32,"connect":1,"send":0,"wait":4,"receive":13,"ssl":6},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"d2te5kruq0pvbl.cloudfront.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}