{"report_id":"c09931f9-bf90-40ff-a1ab-39ba23af0cce","version":6,"status":"done","tags":["amazon","phishing"],"date":"2025-08-28T14:47:11Z","url":{"schema":"https","addr":"amazom6.cyou/","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"amazom6.cyou/#/","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"title":"Amazon"},"submit":{"url":{"schema":"https","addr":"amazom6.cyou/","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-02T14:47:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"summary":[{"fqdn":"amazom6.cyou","ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"domain_registered":"2024-11-15","domain_rank":0,"first_seen":"2025-08-28T14:47:11.675263Z","last_seen":"2025-08-28T14:47:11.675263Z","alert_count":25,"request_count":25,"received_data":7673173,"sent_data":11117,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.220.205.65","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2025-08-28T14:37:49.360516Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":443,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"amazom6.cyou/assets/pages-auth-login.BmZrunpO.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a80d7f511e82299efced0ae1a3bed11","sha1":"05e2aabed8b71a09a81fb340b068e4eb78040639","sha256":"55403c138bcecf1e11adc45de883399b5ae58fa874c38c159fc362ef87ada0dd","sha512":"af885def4a79d0d5bcfef701cfd948d77b03ab20b0eb5183f9d10a64eeb133614d4f69f1768e409a0be22dcc78f5d40c8fa9a62161e0b4724fe42bf7be44d85d","ssdeep":"","tlshash":"9f31ee1db1ecce3619652258755b002061a61d4ec2107d68b3f85b6dff73f8c929a63e","size":1857,"data":"","first_seen":"2025-08-28T14:47:16.61084Z","last_seen":"2025-08-28T14:47:16.61084Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/request.DNkVCpBA.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"importedModule","is_inline":false,"md5":"127b359a3af59802f7555eb09a19868d","sha1":"29f821547c96bcb98d5f09b39a9f184ebd497c90","sha256":"662fdd21cc290974269e9d938418f79e34eeb2563e8638180c30bb9dcefa616d","sha512":"1285de67a35d24424927e7126209cb28e8ae607f0504310e8a1afead705d843b6160adda89ff679bfe8c385cd63a1e375ef696a0813a478aef7b78b15949dea3","ssdeep":"384:RnW8tZL578PmxLNSKnghLCki4QRw1IwaQu:Q8tZL5gPmxLFnghLoOIwaQu","tlshash":"1f52c5c974dd606102d6a4a8983f305bf1263039551dc798b2bed4defcbc5dad022e78","size":13910,"data":"","first_seen":"2025-08-28T14:47:16.58867Z","last_seen":"2025-08-28T14:47:16.58867Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"9fb9d2c62d0b53b369d827901c46d31c","sha1":"bb623e7486aa9ba44851ecc6ae01db5fe42d83a1","sha256":"b02ca87ad43e5ca61f953b2e414559e63f426c8513f7808707f39a4ba04ab219","sha512":"48cbe981398942910959f746a8225a91578752b67121817ae3b6b85859d0e97f9d89e96f1672b63d758f3148f3f37034017fd93d83415097616a90af285f0a18","ssdeep":"","tlshash":"afe061c3506e394c02108119304ac0075bb908b2de8549611c5837a58af9e4bc569455","size":363,"data":"","first_seen":"2025-03-05T00:30:25.174857Z","last_seen":"2026-05-31T15:28:13.961746Z","times_seen":455,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/index-B3jzdy4b.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f2eb434d2572a891db9fa5b2702896f","sha1":"36d503f4a50c0c7e8d249bc8a07745c72e7fa98d","sha256":"da0d346c64c057664185c6a214e77b76846173d86d6bb635e7d4570bbab402c2","sha512":"207f4ed49d848be72806df8da00301acc49d3bd843dbb44bac6320320413f4dc99898a002187f245e05b83506635b880f25c5c65b06e3b1a45917a7d328eba9c","ssdeep":"6144:aNUv81dq08NCEwxiS2SdBVh5oudYYVor7aRtsuqgsPAloggW:aNUv81dq3NpegSd7dY9arYgCggW","tlshash":"a55429e53181b43243ba19e250bb0105b3391a45780ad4d8f17caddb3d3799aa2fbf6d","size":296629,"data":"","first_seen":"2025-08-28T14:47:16.602508Z","last_seen":"2025-08-28T14:47:16.602508Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/auth.ChTTz8V8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"importedModule","is_inline":false,"md5":"7cad803f5bbab4bf5d2c4b054792f7b6","sha1":"95dbeaa60823d9564f2bce846f6c06f75dbde665","sha256":"4c21fb716bb8815a5328f4890bc5518492e23f4e94eb3e5c21dde5de5fcfedaf","sha512":"1b4ddd7d65c7ca7998de1fc0f6f07c96f29f0472b1c05e4ca476e7649d845036bf871932167938e588bc4e7014b2a96c4a6ad458710492a5463f871a3cec70ce","ssdeep":"","tlshash":"28d05e5e0cc3be313374c98abb742205800e5ff0e266aba7b5712c71093c169f2e781a","size":288,"data":"","first_seen":"2025-08-28T14:47:16.566621Z","last_seen":"2025-08-28T14:47:16.566621Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/cache.CJQM5q5g.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"importedModule","is_inline":false,"md5":"691ed42804e77041bbb1e41985e91686","sha1":"f074ea9ae64184dd3b4f36f3ee18f2c7826ee567","sha256":"5dd354e8ba930d84a5ddd4fc936975167489f9e62d9627d6070f8263b444aeb1","sha512":"2f9e30a2772d21fb575e5d795e470ba1c821a7ec159eaff572858d680043483ea53a9ed158fe3a02c5e8074d966abb3a30a9e7368f49a558f9aea1bbda913560","ssdeep":"","tlshash":"78e0e5ac3ea061b19b9f25e009321004b162ec7e3d872a65958720c57c356bdc1aeb2c","size":405,"data":"","first_seen":"2025-08-28T14:47:16.572142Z","last_seen":"2025-08-28T14:47:16.572142Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"importedModule","is_inline":false,"md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","size":91,"data":"","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-07-27T22:12:09.366962Z","times_seen":1766,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"amazom6.cyou/assets/auth.ChTTz8V8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/auth.ChTTz8V8.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://amazom6.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: \"68a43de4-120\"\r\nexpires: Fri, 29 Aug 2025 02:46:58 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 288\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":288,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"7cad803f5bbab4bf5d2c4b054792f7b6","sha1":"95dbeaa60823d9564f2bce846f6c06f75dbde665","sha256":"4c21fb716bb8815a5328f4890bc5518492e23f4e94eb3e5c21dde5de5fcfedaf","sha512":"1b4ddd7d65c7ca7998de1fc0f6f07c96f29f0472b1c05e4ca476e7649d845036bf871932167938e588bc4e7014b2a96c4a6ad458710492a5463f871a3cec70ce","ssdeep":"","tlshash":"28d05e5e0cc3be313374c98abb742205800e5ff0e266aba7b5712c71093c169f2e781a","first_seen":"2025-08-28T14:47:16.566621Z","last_seen":"2025-08-28T14:47:16.566621Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/_plugin-vue_export-helper.BCo6x5W8.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://amazom6.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:59 GMT\r\netag: \"68a43de4-5b\"\r\nexpires: Fri, 29 Aug 2025 02:46:59 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 91\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-07-27T22:12:09.366962Z","times_seen":1766,"resource_available":true,"data":null}},"time_used":1752,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1751,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/cache.CJQM5q5g.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:59.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/cache.CJQM5q5g.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/assets/pages-auth-login.BmZrunpO.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:47:00 GMT\r\netag: \"68a43de4-195\"\r\nexpires: Fri, 29 Aug 2025 02:47:00 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 405\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":405,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (404)","md5":"691ed42804e77041bbb1e41985e91686","sha1":"f074ea9ae64184dd3b4f36f3ee18f2c7826ee567","sha256":"5dd354e8ba930d84a5ddd4fc936975167489f9e62d9627d6070f8263b444aeb1","sha512":"2f9e30a2772d21fb575e5d795e470ba1c821a7ec159eaff572858d680043483ea53a9ed158fe3a02c5e8074d966abb3a30a9e7368f49a558f9aea1bbda913560","ssdeep":"","tlshash":"78e0e5ac3ea061b19b9f25e009321004b162ec7e3d872a65958720c57c356bdc1aeb2c","first_seen":"2025-08-28T14:47:16.572142Z","last_seen":"2025-08-28T14:47:16.572142Z","times_seen":1,"resource_available":true,"data":null}},"time_used":581,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":581,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/username_tit-DOdKs5Bv.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/username_tit-DOdKs5Bv.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\netag: W/\"68a43de4-3e21\"\r\nexpires: Sat, 27 Sep 2025 14:47:01 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15905,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 540 x 78, 8-bit/color RGBA, non-interlaced","md5":"e0b32e8be5c81b80859c9ba27baecf83","sha1":"8323df45d29f646f7cb8bbd5b4d0a6916bc5fade","sha256":"79c72b3baa35b28a202dd2406d9aba2767244a97fd4b06242d8505ab9a10b872","sha512":"95c56bf914b79f1459202abfb1680d5ce083135e7c441d878f15fc696af16995e5063a833a31bd903fda1fc53f94cfe42f5cd247dca7b7226b00aa78b50321ee","ssdeep":"384:Nu33B3cCwE3W/toXli2nwMxzBGZSbts96ctdrjVBJpaa:c33B3k0g+Xo0z1tsD5jVZh","tlshash":"3862c06bdf489f27bc36e3664b371a45c588e7c8b12c79b60d2091cd3584f381e4aa38","first_seen":"2025-01-27T13:25:54.017688Z","last_seen":"2025-10-11T14:50:30.694736Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/static/images/tab/tab_home_s.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /static/images/tab/tab_home_s.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:46:57 GMT\r\netag: W/\"68a3c7fe-77f\"\r\nexpires: Sat, 27 Sep 2025 14:46:57 GMT\r\nlast-modified: Tue, 19 Aug 2025 00:40:30 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 1942\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1919,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"d1994e06177a328488a1dd35299d665e","sha1":"bb900a74f8649d475a1966b1aec58f99d8abde7c","sha256":"7db5d94a842ed560bd261c3deecc0f06d8e3a6b53327d7afb6b0b0a4aa38283e","sha512":"7fa520edff1ec7482e66a1b4432937d077cee0b9c98434aecb1e8c3ba079c4602e621523538470fe559b410f528e6057845c987bc22c69198e489a581ee21e03","ssdeep":"","tlshash":"b1412ac0e6989366f92aa7be58332a20a32e572cc1393058950118365b133ff4526b6e","first_seen":"2025-03-07T08:45:58.519073Z","last_seen":"2025-10-11T14:50:30.685171Z","times_seen":6,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/static/images/tab/tab_mine_n.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /static/images/tab/tab_mine_n.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: \"66962bf2-356\"\r\nexpires: Sat, 27 Sep 2025 14:46:58 GMT\r\nlast-modified: Tue, 16 Jul 2024 08:14:42 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 854\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":854,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 46 x 46, 8-bit colormap, non-interlaced","md5":"0b382d0a5eeb638004988895c5b917e7","sha1":"87d04ad8ff0b88d8c44e1879780637f5d8c2ead2","sha256":"e6170de999220f161ccf0352710ed67116f3f88a0f6ac4645a34a445facdea28","sha512":"30adf55a67c2c73857bbe4acd544cea8df57c795963b11004672f842f2f00bede1c189f1fb32fdd21a30676c5f30fe544b663bdb0e54141b0ec7493e9f1f3a41","ssdeep":"","tlshash":"f8012059236c8c9a4ea4bbb54cac78a5df462244835e432673515c4346750ec3fb3b93","first_seen":"2024-07-03T10:24:56Z","last_seen":"2025-10-11T14:50:30.687564Z","times_seen":71,"resource_available":false,"data":null}},"time_used":600,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":600,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-28T14:46:49.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: text/html\r\ndate: Thu, 28 Aug 2025 14:46:56 GMT\r\netag: \"68a43de4-3c0\"\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 960\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":960,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"a0edf63a861c1edfe24f519b2d8078dd","sha1":"a256dc37138eba44ef38a7645716af8942a3da7e","sha256":"e145d76ef2ceb67b7d09dad839e989619508585bb34b1ece436a163d79efc0d7","sha512":"ae64a581cd59f081f2934e106e8768b2a549ff4682bc75846edbc6a128ba43e4fbf425c5b34c4c26a63c792ed722adf6c192e79aa04def8575b21d826b9aa22d","ssdeep":"","tlshash":"b711504634157f09033047492072c01c56b79e36b514a97138e622bb6fd1b8ac99e8b2","first_seen":"2025-08-28T14:47:16.585653Z","last_seen":"2025-08-28T14:47:16.585653Z","times_seen":1,"resource_available":false,"data":null}},"time_used":8475,"timings":{"blocked":1524,"dns":1477,"connect":19,"send":0,"wait":5421,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/request.DNkVCpBA.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:59.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/request.DNkVCpBA.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/assets/pages-auth-login.BmZrunpO.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:47:00 GMT\r\netag: W/\"68a43de4-3656\"\r\nexpires: Fri, 29 Aug 2025 02:47:00 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13910,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (13906)","md5":"127b359a3af59802f7555eb09a19868d","sha1":"29f821547c96bcb98d5f09b39a9f184ebd497c90","sha256":"662fdd21cc290974269e9d938418f79e34eeb2563e8638180c30bb9dcefa616d","sha512":"1285de67a35d24424927e7126209cb28e8ae607f0504310e8a1afead705d843b6160adda89ff679bfe8c385cd63a1e375ef696a0813a478aef7b78b15949dea3","ssdeep":"384:RnW8tZL578PmxLNSKnghLCki4QRw1IwaQu:Q8tZL5gPmxLFnghLoOIwaQu","tlshash":"1f52c5c974dd606102d6a4a8983f305bf1263039551dc798b2bed4defcbc5dad022e78","first_seen":"2025-08-28T14:47:16.58867Z","last_seen":"2025-08-28T14:47:16.58867Z","times_seen":1,"resource_available":true,"data":null}},"time_used":968,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":968,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/top_log-qY2LidqA.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/top_log-qY2LidqA.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\netag: W/\"68a43de4-2c5d\"\r\nexpires: Sat, 27 Sep 2025 14:47:01 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11357,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 361 x 152, 8-bit/color RGBA, non-interlaced","md5":"887635d4a31d1b2381afabd36931f645","sha1":"e4ab2c49b5f7bcca79d74b3a1a311800940fad43","sha256":"8e29799ea296e7c20eab05c51db4826a3b3ede79891fed118b122861af5590e0","sha512":"bc0c407625265fbb7864eb2be339ae918851a0e0d982e595f526cc239512b0fb1951fdf042e0aa863f53f99c7a716e10e1f95acb92e74956e346dfb5b5a1ba29","ssdeep":"192:daaij+7wCtfSQLMvAKiFRSj4eP8pt+IOZUQwsL9efPKri7jvt:daa6swCEVvARMjxk//lQN5YPKGjl","tlshash":"b432aebd29007549a1ecdfac4acd1ce3540f9a2d18dbec78a661dcc93a551862cce6c1","first_seen":"2025-01-27T13:25:54.021783Z","last_seen":"2025-10-11T14:50:30.694015Z","times_seen":9,"resource_available":false,"data":null}},"time_used":1081,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1081,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/login_btn-yFKaieg7.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/login_btn-yFKaieg7.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\netag: W/\"68a43de4-197a\"\r\nexpires: Sat, 27 Sep 2025 14:47:01 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6522,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 606 x 96, 8-bit/color RGBA, non-interlaced","md5":"2610d2923e2fe3f61bb46afa07747344","sha1":"685339a1861305762697dc4e86e072153d51e749","sha256":"5464c4a02dd231ab83ea25dea7b195c214581fc014737a5305dd2a82d2dcbf45","sha512":"50c4a23018504313574fcd754def9cbaaf6609d23df231c7b15ebc7bf06544a741ef420ad5758b3cd733edd81ddaa2623ea3fe5102af9a36e069ea5e0c98c06b","ssdeep":"96:R5lxFayjCC9OLoUP+HEL2bp/Ln288jaa3HL/hW/LQQfgv08pxRGSRA:L0KCCgLoUfKRn2ZVHI/LtA06ESO","tlshash":"8ed18d62d7e24e530d8a26ff7ed212d468af16304b7cfc7226c2a655b8bf06846fd405","first_seen":"2025-01-27T13:55:10.769951Z","last_seen":"2025-10-11T14:50:30.683875Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1072,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1072,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/index-B3jzdy4b.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:56.423Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/index-B3jzdy4b.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:56 GMT\r\netag: W/\"68a43de4-486b5\"\r\nexpires: Fri, 29 Aug 2025 02:46:56 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":296629,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (33333)","md5":"1f2eb434d2572a891db9fa5b2702896f","sha1":"36d503f4a50c0c7e8d249bc8a07745c72e7fa98d","sha256":"da0d346c64c057664185c6a214e77b76846173d86d6bb635e7d4570bbab402c2","sha512":"207f4ed49d848be72806df8da00301acc49d3bd843dbb44bac6320320413f4dc99898a002187f245e05b83506635b880f25c5c65b06e3b1a45917a7d328eba9c","ssdeep":"6144:aNUv81dq08NCEwxiS2SdBVh5oudYYVor7aRtsuqgsPAloggW:aNUv81dq3NpegSd7dY9arYgCggW","tlshash":"a55429e53181b43243ba19e250bb0105b3391a45780ad4d8f17caddb3d3799aa2fbf6d","first_seen":"2025-08-28T14:47:16.602508Z","last_seen":"2025-08-28T14:47:16.602508Z","times_seen":1,"resource_available":true,"data":null}},"time_used":612,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":612,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/auth.ChTTz8V8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:59.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/auth.ChTTz8V8.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/assets/pages-auth-login.BmZrunpO.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:59 GMT\r\netag: \"68a43de4-120\"\r\nexpires: Fri, 29 Aug 2025 02:46:59 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 288\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":288,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"7cad803f5bbab4bf5d2c4b054792f7b6","sha1":"95dbeaa60823d9564f2bce846f6c06f75dbde665","sha256":"4c21fb716bb8815a5328f4890bc5518492e23f4e94eb3e5c21dde5de5fcfedaf","sha512":"1b4ddd7d65c7ca7998de1fc0f6f07c96f29f0472b1c05e4ca476e7649d845036bf871932167938e588bc4e7014b2a96c4a6ad458710492a5463f871a3cec70ce","ssdeep":"","tlshash":"28d05e5e0cc3be313374c98abb742205800e5ff0e266aba7b5712c71093c169f2e781a","first_seen":"2025-08-28T14:47:16.566621Z","last_seen":"2025-08-28T14:47:16.566621Z","times_seen":1,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":386,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/uni.c1ae2177.css","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:56.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/uni.c1ae2177.css HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Thu, 28 Aug 2025 14:46:56 GMT\r\netag: W/\"68a43de4-285b\"\r\nexpires: Fri, 29 Aug 2025 02:46:56 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 2802\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10331,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10330)","md5":"c7d5993ca0673e1f7b86fca9eaa6c3ae","sha1":"7ca1209f56330c0b33c84edad8e91f6aa922b55f","sha256":"c1ae21778b8ae2376443ba54e3d04fbfc6d0558f38029a647ddebc34317db831","sha512":"72a4070ea1491e9ed3d533d2ca86f10a9372241b6d0502a5d528453c1a2ef4c7fff4f8fdf240f9a6ce8f1149badaeef3c05e70a73d5acca96d36de7aa34842f7","ssdeep":"96:mBunNXVAG5QRhgA+l+wcrI+s/b7LQ17wBNZc7qtmD/PFhZKwbE//ie7Lpbc/yKlO:dNXVA8e+l+Qb741OED/PhcvNc/J4wc","tlshash":"832222310e422d27e8bbcb2269d1d75e1236c932e9630b5e937cb41ccb5e8dc16ea745","first_seen":"2025-08-28T14:47:16.605656Z","last_seen":"2025-10-11T14:50:30.688238Z","times_seen":2,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/cache.CJQM5q5g.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/cache.CJQM5q5g.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://amazom6.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:59 GMT\r\netag: \"68a43de4-195\"\r\nexpires: Fri, 29 Aug 2025 02:46:59 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 405\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":405,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (404)","md5":"691ed42804e77041bbb1e41985e91686","sha1":"f074ea9ae64184dd3b4f36f3ee18f2c7826ee567","sha256":"5dd354e8ba930d84a5ddd4fc936975167489f9e62d9627d6070f8263b444aeb1","sha512":"2f9e30a2772d21fb575e5d795e470ba1c821a7ec159eaff572858d680043483ea53a9ed158fe3a02c5e8074d966abb3a30a9e7368f49a558f9aea1bbda913560","ssdeep":"","tlshash":"78e0e5ac3ea061b19b9f25e009321004b162ec7e3d872a65958720c57c356bdc1aeb2c","first_seen":"2025-08-28T14:47:16.572142Z","last_seen":"2025-08-28T14:47:16.572142Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1557,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1557,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/pages-auth-login.BmZrunpO.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.731Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/pages-auth-login.BmZrunpO.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://amazom6.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: W/\"68a43de4-741\"\r\nexpires: Fri, 29 Aug 2025 02:46:58 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 818\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1857,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1856)","md5":"7a80d7f511e82299efced0ae1a3bed11","sha1":"05e2aabed8b71a09a81fb340b068e4eb78040639","sha256":"55403c138bcecf1e11adc45de883399b5ae58fa874c38c159fc362ef87ada0dd","sha512":"af885def4a79d0d5bcfef701cfd948d77b03ab20b0eb5183f9d10a64eeb133614d4f69f1768e409a0be22dcc78f5d40c8fa9a62161e0b4724fe42bf7be44d85d","ssdeep":"","tlshash":"9f31ee1db1ecce3619652258755b002061a61d4ec2107d68b3f85b6dff73f8c929a63e","first_seen":"2025-08-28T14:47:16.61084Z","last_seen":"2025-08-28T14:47:16.61084Z","times_seen":1,"resource_available":true,"data":null}},"time_used":971,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":971,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/pages-auth-login.BmZrunpO.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:58.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/pages-auth-login.BmZrunpO.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/assets/index-B3jzdy4b.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:59 GMT\r\netag: W/\"68a43de4-741\"\r\nexpires: Fri, 29 Aug 2025 02:46:59 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 818\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1857,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1856)","md5":"7a80d7f511e82299efced0ae1a3bed11","sha1":"05e2aabed8b71a09a81fb340b068e4eb78040639","sha256":"55403c138bcecf1e11adc45de883399b5ae58fa874c38c159fc362ef87ada0dd","sha512":"af885def4a79d0d5bcfef701cfd948d77b03ab20b0eb5183f9d10a64eeb133614d4f69f1768e409a0be22dcc78f5d40c8fa9a62161e0b4724fe42bf7be44d85d","ssdeep":"","tlshash":"9f31ee1db1ecce3619652258755b002061a61d4ec2107d68b3f85b6dff73f8c929a63e","first_seen":"2025-08-28T14:47:16.61084Z","last_seen":"2025-08-28T14:47:16.61084Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/favicon.ico","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:59.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/x-icon\r\ndate: Thu, 28 Aug 2025 14:46:59 GMT\r\netag: \"68a3ee85-25be\"\r\nlast-modified: Tue, 19 Aug 2025 03:24:53 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 9662\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9662,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"ae08752fb554a7cbab87e18f5d4f204a","sha1":"792207971449784f5a253b96c17de0d2770891ff","sha256":"13f5d31d0320edadc7e94c5941e37b7adae8073e658ef8e1b32eaf303840c5a4","sha512":"4cb50e6f4479af01911f6c6ac4a93e58068079b53f30f00fe42792d74700b829d47206925fadfac88d9f5b9207a8e5b70373c6ac48dc1bab4fce917013d1ba91","ssdeep":"96:9m+3pGwUfp5SPPumkQeQx3Cnx8F9MhzVFdk9KOHejytrtvF:/3sSeKli9Hdkc6Xrt","tlshash":"8d129880988c7dfbe0266db707712a3532f5efa9646f1d642452f421e5bd4a3723a80b","first_seen":"2024-10-04T15:53:49Z","last_seen":"2025-10-11T14:50:30.675058Z","times_seen":67,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":290,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/password_tit-B1jd-Z72.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/password_tit-B1jd-Z72.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\netag: W/\"68a43de4-2e1e\"\r\nexpires: Sat, 27 Sep 2025 14:47:01 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11806,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 389 x 78, 8-bit/color RGBA, non-interlaced","md5":"38069ca0ae481513bd67d030b0fdcb4c","sha1":"434b41bde0c63ad61efd41d7a2d7132fcf271ec1","sha256":"7142404b3620c72dfa93fa7cf01e4b3854355a76185d875d3061c7ca8a85ab60","sha512":"d61d4eb4ed11c3c8790aeb5f991ceb9318b385255d804d1472cbf3288eca0f2287bd739f04f3aad8e822e194d8b6049882708beda0da0887c5b58a49099d2ed2","ssdeep":"192:Oy9EAPbhwVRQykEivse54tG0toAjq9zAxlDK5GzXnVsdTQRvFm14HDBIV2dhgKM0:Oy9E8bhwV6ykEdCn0tu0HDK5GzX2V6d1","tlshash":"d132c124cdc9499b9726b5487fb5176e1036e3ebc09533b20bb3a1c1a841ddb925f233","first_seen":"2025-03-07T08:45:58.524432Z","last_seen":"2025-10-11T14:50:30.681502Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1071,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1071,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/toreg_tip-G3kqet9B.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/toreg_tip-G3kqet9B.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\netag: W/\"68a43de4-2597\"\r\nexpires: Sat, 27 Sep 2025 14:47:01 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9623,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 482 x 37, 8-bit/color RGBA, non-interlaced","md5":"8a9d9bf1477b17ad050250734e94f7eb","sha1":"81546ec873d0472a5d2ac201721ae9fc99af4e07","sha256":"82a428ab814b657c5fddc7ea16354f67be6fd2dfe1c4967d98bb55881713fa46","sha512":"6fee0ce8172e1b768afc338077cb309ae779f70b7a0a5aad1b44c6755156c1756808a49868fc8a115760cf1067ec0bd32ab08e3e11fe6512696ad836aa3c54d5","ssdeep":"192:XskHQHjfIRyKLmhvd6z6czP1ujc+TyOgZIKgeKrtf3+h1RR5ymD:8kwHSyKLmhvde6mHIKgekS1R6M","tlshash":"8212bfd9ebd117c3d6f8ffc469089ae01f636568d2b29eda978303666834b06c5d204d","first_seen":"2025-01-27T13:55:10.768562Z","last_seen":"2025-10-11T14:50:30.647013Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1071,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1071,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/index-C--5-gVh.css","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:56.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/index-C--5-gVh.css HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Thu, 28 Aug 2025 14:46:57 GMT\r\netag: W/\"68a43de4-a7ca\"\r\nexpires: Fri, 29 Aug 2025 02:46:57 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42954,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (42953)","md5":"df4ee75794caeadb9afdbb63ecd5781c","sha1":"5c443968e9e165c76ee21e62a2f1c2c529753246","sha256":"e7464844d738c87a64ffa55542098e22936fe35021d2a56bdb54d33cf588af67","sha512":"5af91013d05621e1a21f14dfc42ae35205aaa87748a17187aa91eadbd44719fe762d6d1ccdb82c79620734c12af2349f44b6ab1ffe2584328119a4ff130c9e18","ssdeep":"384:qgDzFzaXJDuVYFOzzzDz9zRz/zYhdmRQfktQx37XchyaL9wDLONShck8WFiK5o6h:RDpO7Unfh17RsxrXGyY92LONSh1JV10Y","tlshash":"4b13ae316e562c3efdabc96ed093e9f3b3019732906266dbfb71f426c99c9c40521648","first_seen":"2025-08-28T14:47:16.619704Z","last_seen":"2025-10-11T14:50:30.66266Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/static/images/tab/tab_task_n.png","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /static/images/tab/tab_task_n.png HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: W/\"68a3c7fe-7ba\"\r\nexpires: Sat, 27 Sep 2025 14:46:58 GMT\r\nlast-modified: Tue, 19 Aug 2025 00:40:30 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 1967\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1978,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"d2b3d61c5646499186086bc09d04a174","sha1":"fca148a3286c4616965900f8752a39519e981f01","sha256":"a8d1a220dc3d6c22381344ca3f771c34c1432d0e2151b7e2452902e190bd4de5","sha512":"ac27c8cc44d77f586136cbf195718c402676f0ace01bfe7c81818522afdf1046739438aab6028a13e23fd346ca6786fc12cd93e02388206bf5d35a6f33be121d","ssdeep":"","tlshash":"364128139937056212aa654717e96cf103b4abb8b501c620fcb1c1cca0183afbd9e4a2","first_seen":"2025-03-07T08:45:58.52294Z","last_seen":"2025-10-11T14:50:30.693038Z","times_seen":6,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":408,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/login-DUlQGB7T.css","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/login-DUlQGB7T.css HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: W/\"68a43de4-4d4\"\r\nexpires: Fri, 29 Aug 2025 02:46:58 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\ncontent-length: 423\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1236,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1235)","md5":"d9ea701ae5ea97a49b76ddb576e38e97","sha1":"16f8b1f425585244425fe52829c6b288feb0d8c5","sha256":"fdd8b77e92b6d524c01e126e2664b8151d1791f31dd15d39dc17a567b37cb310","sha512":"0785dadc0f2772072b3d105d6508be33f2809df63cfef37f470513cb7eff9c7599e8806dfc573320981af899c89e5f8ace12aacedc3e420c1164e74e44e849dc","ssdeep":"","tlshash":"f621f79e2f4c90c962bf9323262946ea591eb61d5642cf3d6e322f11bcd3fca2537450","first_seen":"2025-04-20T10:24:46.25155Z","last_seen":"2025-10-11T14:50:30.67974Z","times_seen":4,"resource_available":false,"data":null}},"time_used":779,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":779,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.220.205.65","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 28 Aug 2025 14:47:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Thu, 28 Aug 2025 15:47:01 GMT\r\ncache-control: max-age=3600\r\nset-cookie: __uni__uid=rBEQRWiwa+Vxf28VA7XtAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-28T10:05:58.923574Z","times_seen":17981,"resource_available":false,"data":null}},"time_used":1536,"timings":{"blocked":641,"dns":1,"connect":254,"send":0,"wait":254,"receive":0,"ssl":383},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/request.DNkVCpBA.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:57.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/request.DNkVCpBA.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://amazom6.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:46:58 GMT\r\netag: W/\"68a43de4-3656\"\r\nexpires: Fri, 29 Aug 2025 02:46:58 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13910,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (13906)","md5":"127b359a3af59802f7555eb09a19868d","sha1":"29f821547c96bcb98d5f09b39a9f184ebd497c90","sha256":"662fdd21cc290974269e9d938418f79e34eeb2563e8638180c30bb9dcefa616d","sha512":"1285de67a35d24424927e7126209cb28e8ae607f0504310e8a1afead705d843b6160adda89ff679bfe8c385cd63a1e375ef696a0813a478aef7b78b15949dea3","ssdeep":"384:RnW8tZL578PmxLNSKnghLCki4QRw1IwaQu:Q8tZL5gPmxLFnghLoOIwaQu","tlshash":"1f52c5c974dd606102d6a4a8983f305bf1263039551dc798b2bed4defcbc5dad022e78","first_seen":"2025-08-28T14:47:16.58867Z","last_seen":"2025-08-28T14:47:16.58867Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1363,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:46:59.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/_plugin-vue_export-helper.BCo6x5W8.js HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/assets/pages-auth-login.BmZrunpO.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: application/javascript\r\ndate: Thu, 28 Aug 2025 14:47:00 GMT\r\netag: \"68a43de4-5b\"\r\nexpires: Fri, 29 Aug 2025 02:47:00 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 91\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-07-27T22:12:09.366962Z","times_seen":1766,"resource_available":true,"data":null}},"time_used":777,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":777,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amazom6.cyou/assets/bg_login-B6J4ikan.gif","fqdn":"amazom6.cyou","domain":"amazom6.cyou","tld":"cyou"},"ip":{"addr":"38.60.250.187","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amazom6.cyou/","date":"2025-08-28T14:47:00.731Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"amazom6.cyou","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Sun, 03 Aug 2025 04:25:44 GMT","end":"Sat, 01 Nov 2025 04:25:43 GMT"},"fingerprint":{"sha1":"E5:DC:45:40:C6:8C:D4:0A:37:41:5E:23:9A:5A:DA:6C:E7:36:F3:DD","sha256":"73:C7:C9:40:44:35:88:85:7A:2A:A8:74:EC:10:8B:8B:39:F6:9E:BD:73:95:59:F4:AB:B5:6F:DB:E0:27:49:F6"}}},"request":{"raw":"GET /assets/bg_login-B6J4ikan.gif HTTP/1.1\r\nHost: amazom6.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amazom6.cyou/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncontent-type: image/gif\r\ndate: Thu, 28 Aug 2025 14:47:00 GMT\r\netag: W/\"68a43de4-6e0525\"\r\nexpires: Sat, 27 Sep 2025 14:47:00 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:03:32 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: BYPASS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7210277,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 750 x 500","md5":"839a4fa38f3bf4e8b41a3a2badd537f4","sha1":"261a3d84447029b8efd29b0b33f52d588bda6c47","sha256":"79493b92fb41eee5342bff492efa35a7542ea6e7a8075a95e267b070457ee03c","sha512":"d91bdd1ff7a7ad358ee0c79c5cea25cefb4ecb7b3d6e91fbf56d1fb63751701e0443ba7d4e9f38456a2440c614cf5a5a00bb72cb4e313bdb3d46f40f42a93db8","ssdeep":"24576:d/ys/j7FMwGu4qiAT09c3voa92jYFsmfKWc/KgIkynVwr:dpPas/oakXmiz4V0","tlshash":"53253325e4ba124d993559e32587387b00189cedd1f7da36dc9b307fc3cae860a92763","first_seen":"2025-08-28T14:47:16.628016Z","last_seen":"2025-10-11T14:50:30.678132Z","times_seen":2,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}}]}