{"report_id":"e146397a-a6d0-4157-9445-67464c168a9c","version":0,"status":"done","tags":["amazon","phishing"],"date":"2026-07-20T12:46:11Z","url":{"schema":"http","addr":"ht1.ht.htamzoj.icu","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":0,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/#/","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"title":"Amazon","dom":{"size":236101,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40058), with CRLF, LF line terminators","md5":"aaf2b394729652f5ed637b088c2a77ba","sha1":"82cff9ea4a5f6b54d2c3ca8fe02a673324444a64","sha256":"f1d4037aba185d985c63e711c624f53ee6c7aec1d9f3892c9e37bce3eec632a3","sha512":"06ed6ba31d4b31de3f23fdc947c1a0a0f3e805d8ae9219799e6d13bae1302e9293255efe9675d75fa7926b17c518aa26342320523a0af89cbf9dbe5a5d1c6054","ssdeep":"6144:Qrr7fnFzHh9Af3Rkn/jSqAEs9UG9OZhmW9j9SKNTR:Qr3npHh9Af3Rkn/eutIKH","tlshash":"9f34d5b2b589289dab37c9c2c144bb7dbdaf6e77c2464cd6e31127288f816d3221471d","dom_hash":"domhashb53e6f50a18a0ecc9253589cf6d86c82","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ht1.ht.htamzoj.icu","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":0,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-24T12:46:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"summary":[{"fqdn":"ht1.ht.htamzoj.icu","ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-12-23","domain_rank":0,"first_seen":"2026-01-04T07:26:27.291285Z","last_seen":"2026-07-06T02:03:11.013971Z","alert_count":36,"request_count":12,"received_data":1381804,"sent_data":6710,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.220.203.60","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-07-17T17:37:56.175091Z","alert_count":0,"request_count":1,"received_data":577,"sent_data":553,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-07-21T08:05:17.86677Z","times_seen":4529,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/chunk-vendors.d47216be.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"95dd52ada79faef0d90a59d71dc57410","sha1":"a5bd7bc5a7d9aceb7468e792e8e0457a341763e8","sha256":"5713e4b536cc7d4164de7915effe662e2fa24feb318473941d07e715724c7b8f","sha512":"4d3e068169e54265c08287d99b8dacf0ecd38bd906d01437c0f4f25789ba2b5375b0b410a48cb7769db69a165a599f267ba12ce5f327eb715b633ddc9b21805e","ssdeep":"6144:aVMwTfmVKb/eSbfLNHzzY3vm7UQeXhN+jvHzLPNZ/bYaQF2dePerr7fnF64iXcOp:aewTOdSjLhIFQ9vHzDz3JBr3nE8Oj5G2","tlshash":"0715088df285b0b51be760b5403f220bb2377969b40a84d4f675e4d4ad78a4e2227f3d","size":903122,"data":"","first_seen":"2025-11-09T12:54:48.405097Z","last_seen":"2026-07-20T15:45:09.055803Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/index.6dfeb497.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8760037379ce785c447970b326eb4d1","sha1":"3d3dafa38cfa9a4c5b8e65bc9ee53fae2af025f3","sha256":"0c20442228af927a31902a918012a79880792a76d55f44661855aa816d09ef56","sha512":"2d8c8235224300cadd40746b0ee88305caafe949d69fe7d620ba909cb732e57ba5dc8002e023df71000cf7723dc4abe224320b7478cf0057d0e1ef4507ace2e1","ssdeep":"3072:+G0fHY7oaCIbWEQeCoxaGuM9bl+U05lKXxBxz7Dg:AfHKoaChEQToB7U","tlshash":"5534f9c2b6c9103e8f831f85d06b36fcf6bb1c638149e4c7e5d17fb95a99986120a61c","size":243584,"data":"","first_seen":"2026-01-03T19:07:01.390561Z","last_seen":"2026-07-20T15:45:09.058815Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f733d571164cea4063895fccaf3a3f91","sha1":"c6b846e94da54056235f76d96afe96566edcd551","sha256":"6027f911d1f38fc6f9c725f92107d0e5583ffb89f01af79c22b12fceb412bd56","sha512":"6190b2cc65459140101bcc8bb857a1e1b34e0b1956eacdefee40a22836b05dc6a24dcbef9bc5b6e6de3f407b30640c8241e880c6edb1b518ee160bf2be11c9e3","ssdeep":"384:DCm9GCDeq4zhMBwoJ0ihWGPtHU9A8SPNknxZxndGX9ascem9Fsi:Dj4CDeRh4x0ihjPtHU9A8SPNknxZxd82","tlshash":"9ba2f616b0c7e4a70e93586415ab520a90337e5c8825f5d5e7b1b6fa0cf6e8f131af2c","size":23149,"data":"","first_seen":"2025-11-09T12:54:48.40729Z","last_seen":"2026-07-20T15:45:09.063112Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/pages-home-index.1fa7dcd1.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d2685b69f2cefcdef7367479137a2da3","sha1":"c241addccd2063d38847fa42d098042b33f5326b","sha256":"bf5c54c29dd672082330f67cdef62946b3372a72a020e8049170917157dd7e25","sha512":"a8849f7c7d2be03cca9d6afb0eb6003887ea43f204d7642f4d52a78a770d70a2673376648396a8518c7437c30de752b9199cad2e9933c539fa6d5c58ed9a3626","ssdeep":"768:7NGElnwLeu/xF/vfcijS/TNUppy5pUOmQ4ikGfr6NVBDVw:kElwLeu/xF3f65SOwibfr6NBw","tlshash":"8013cf3660d7b8ef8e936a41b01757199cbd3e5bf514f0c21b64dee0c5e0a0b351aa98","size":41456,"data":"","first_seen":"2026-01-03T19:07:01.388005Z","last_seen":"2026-07-20T15:45:09.054281Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"App Launch","filename":"https://ht1.ht.htamzoj.icu/h5/static/js/index.6dfeb497.js","line_number":1,"column_number":34726},{"level":"log","text":"App Show","filename":"https://ht1.ht.htamzoj.icu/h5/static/js/index.6dfeb497.js","line_number":1,"column_number":34771},{"level":"log","text":"滚动到顶部","filename":"https://ht1.ht.htamzoj.icu/h5/static/js/pages-home-index.1fa7dcd1.js","line_number":1,"column_number":40579},{"level":"log","text":"滚动到顶部","filename":"https://ht1.ht.htamzoj.icu/h5/static/js/pages-home-index.1fa7dcd1.js","line_number":1,"column_number":40579}]},"http":[{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/assets/6666.aebcf570.jpg","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.954Z","timestamp":1784551542954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/assets/6666.aebcf570.jpg HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:27:53 GMT\r\netag: \"6f83-646df0d2da8b2\"\r\naccept-ranges: bytes\r\ncontent-length: 28547\r\ncontent-type: image/jpeg\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":28547,"size_decoded":28780,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1000x666, components 3","md5":"aebcf5704aff5247b07b2528e88cdaeb","sha1":"2443ff609d60b212a5b7fb49001a6d72425e50f3","sha256":"fe62ae947000f17c9b806ee886214dab6a6c0b7d3d02132cf54f75ab089cd232","sha512":"52096f63401845c4cfa18398a7a5960dbbb4ce423964549e715be49d128a4868ba0385cdb391458abac3c50f4dbef42415ee2bd7ff4568f338ffc0a10a626769","ssdeep":"384:k9mGOxf70wvhhFDRi17+c4RKZJZmih/88T+UerDcZRX19TS43CoZyGEByv:bDbn/ER4wZVh/VTcQZX9Tx3CoZY8","tlshash":"95d2dfffcb4e6587e85857b2e2c2b603f1437e0056ea653acf404b096e8eac16d74344","first_seen":"2025-12-02T02:35:09.228696Z","last_seen":"2026-07-20T15:45:09.052001Z","times_seen":28,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/index.6dfeb497.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.012Z","timestamp":1784551542012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/js/index.6dfeb497.js HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:09 GMT\r\netag: \"3b780-646df0e28949b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":243584,"size_decoded":69120,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63692), with no line terminators","md5":"b8760037379ce785c447970b326eb4d1","sha1":"3d3dafa38cfa9a4c5b8e65bc9ee53fae2af025f3","sha256":"0c20442228af927a31902a918012a79880792a76d55f44661855aa816d09ef56","sha512":"2d8c8235224300cadd40746b0ee88305caafe949d69fe7d620ba909cb732e57ba5dc8002e023df71000cf7723dc4abe224320b7478cf0057d0e1ef4507ace2e1","ssdeep":"3072:+G0fHY7oaCIbWEQeCoxaGuM9bl+U05lKXxBxz7Dg:AfHKoaChEQToB7U","tlshash":"5534f9c2b6c9103e8f831f85d06b36fcf6bb1c638149e4c7e5d17fb95a99986120a61c","first_seen":"2026-01-03T19:07:01.390561Z","last_seen":"2026-07-20T15:45:09.058815Z","times_seen":16,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.220.203.60","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:45.441Z","timestamp":1784551545441,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 20 Jul 2026 12:45:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Mon, 20 Jul 2026 15:45:46 GMT\r\ncache-control: max-age=10800\r\nset-cookie: __uni__uid=rBEQiWpeGHo/v9m8A6KpAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":577,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-21T14:30:47.436378Z","times_seen":17352,"resource_available":false,"data":null}},"time_used":800,"timings":{"blocked":0,"dns":5,"connect":198,"send":0,"wait":196,"receive":0,"ssl":401},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.778Z","timestamp":1784551542778,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:20 GMT\r\netag: \"5a6d-646df0ed05ec1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5913\r\ncontent-type: text/javascript\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":23149,"size_decoded":6202,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (21115), with no line terminators","md5":"f733d571164cea4063895fccaf3a3f91","sha1":"c6b846e94da54056235f76d96afe96566edcd551","sha256":"6027f911d1f38fc6f9c725f92107d0e5583ffb89f01af79c22b12fceb412bd56","sha512":"6190b2cc65459140101bcc8bb857a1e1b34e0b1956eacdefee40a22836b05dc6a24dcbef9bc5b6e6de3f407b30640c8241e880c6edb1b518ee160bf2be11c9e3","ssdeep":"384:DCm9GCDeq4zhMBwoJ0ihWGPtHU9A8SPNknxZxndGX9ascem9Fsi:Dj4CDeRh4x0ihjPtHU9A8SPNknxZxd82","tlshash":"9ba2f616b0c7e4a70e93586415ab520a90337e5c8825f5d5e7b1b6fa0cf6e8f131af2c","first_seen":"2025-11-09T12:54:48.40729Z","last_seen":"2026-07-20T15:45:09.063112Z","times_seen":31,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T12:45:39.740Z","timestamp":1784551539740,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\ncache-control: no-cache,must-revalidate\r\nset-cookie: think_lang=en-us; path=/\nPHPSESSID=6e32224311e99e50533cc77f2fc6320a; expires=Tue, 21-Jul-2026 12:45:41 GMT; Max-Age=86400; path=/\r\nlocation: /h5\r\ncontent-length: 0\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 20 Jul 2026 12:45:41 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T17:24:28.523367Z","times_seen":17427003,"resource_available":true,"data":null}},"time_used":1741,"timings":{"blocked":-1,"dns":1268,"connect":99,"send":0,"wait":172,"receive":0,"ssl":202},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/index.2da1efab.css","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.004Z","timestamp":1784551542004,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/index.2da1efab.css HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:02 GMT\r\netag: \"178f9-646df0dbc0eb1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 26185\r\ncontent-type: text/css\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":96505,"size_decoded":26469,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"73ae6c583d02d78f81e3f18860a2899a","sha1":"07df9233fc11dddc34fbf519b891d40b2ac29c0f","sha256":"e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83","sha512":"da54ba9dbe06d8d763f3cfd64cf5babb54e761e3208c7a2f23e845290c48db8c115bb86c24262cd6c9a96ff2e51674c6d86439e1814baf2de7980f5c06349921","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nKhlvbc:VApuK7hmVrS1Wu3iG41nKPI","tlshash":"1893f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2024-01-02T00:07:11Z","last_seen":"2026-07-21T17:48:31.525472Z","times_seen":6363,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T12:45:41.604Z","timestamp":1784551541604,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Sun, 28 Dec 2025 15:11:27 GMT\r\netag: \"323-647048a6851e0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 492\r\ncontent-type: text/html\r\ndate: Mon, 20 Jul 2026 12:45:41 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":803,"size_decoded":773,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (519), with CRLF line terminators","md5":"6af68b689ca91705242083729515fed9","sha1":"85481a12e8a09138ec3efd50e5ad671feb7115b3","sha256":"c4b2205c1a4254e266fa220481fb376fbb468c6d5f253cb0ff9de1b4cfee7fc4","sha512":"cedca7cec6eb2f3b18218964627700fdb6b039a3f98996a75bbc000c84f25d9cb62ca7003795d6789f9d8bcd2ccb71802a972f452655407c9a077f334c72b8fd","ssdeep":"","tlshash":"0401cec25c21a04d1720865174b6e11e4ada45b9a991cd1178ac26ed4bf0b8edd6f810","first_seen":"2026-01-03T19:07:01.380806Z","last_seen":"2026-07-20T15:45:09.050195Z","times_seen":16,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/chunk-vendors.d47216be.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.006Z","timestamp":1784551542006,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.d47216be.js HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:08 GMT\r\netag: \"dc7d2-646df0e1867e1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":903122,"size_decoded":293535,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64698), with no line terminators","md5":"95dd52ada79faef0d90a59d71dc57410","sha1":"a5bd7bc5a7d9aceb7468e792e8e0457a341763e8","sha256":"5713e4b536cc7d4164de7915effe662e2fa24feb318473941d07e715724c7b8f","sha512":"4d3e068169e54265c08287d99b8dacf0ecd38bd906d01437c0f4f25789ba2b5375b0b410a48cb7769db69a165a599f267ba12ce5f327eb715b633ddc9b21805e","ssdeep":"6144:aVMwTfmVKb/eSbfLNHzzY3vm7UQeXhN+jvHzLPNZ/bYaQF2dePerr7fnF64iXcOp:aewTOdSjLhIFQ9vHzDz3JBr3nE8Oj5G2","tlshash":"0715088df285b0b51be760b5403f220bb2377969b40a84d4f675e4d4ad78a4e2227f3d","first_seen":"2025-11-09T12:54:48.405097Z","last_seen":"2026-07-20T15:45:09.055803Z","times_seen":31,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/js/pages-home-index.1fa7dcd1.js","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.780Z","timestamp":1784551542780,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/js/pages-home-index.1fa7dcd1.js HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:21 GMT\r\netag: \"a1f0-646df0ee1857c-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 25026\r\ncontent-type: text/javascript\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41456,"size_decoded":25316,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40942), with no line terminators","md5":"d2685b69f2cefcdef7367479137a2da3","sha1":"c241addccd2063d38847fa42d098042b33f5326b","sha256":"bf5c54c29dd672082330f67cdef62946b3372a72a020e8049170917157dd7e25","sha512":"a8849f7c7d2be03cca9d6afb0eb6003887ea43f204d7642f4d52a78a770d70a2673376648396a8518c7437c30de752b9199cad2e9933c539fa6d5c58ed9a3626","ssdeep":"768:7NGElnwLeu/xF/vfcijS/TNUppy5pUOmQ4ikGfr6NVBDVw:kElwLeu/xF3f65SOwibfr6NBw","tlshash":"8013cf3660d7b8ef8e936a41b01757199cbd3e5bf514f0c21b64dee0c5e0a0b351aa98","first_seen":"2026-01-03T19:07:01.388005Z","last_seen":"2026-07-20T15:45:09.054281Z","times_seen":16,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/favicon.ico","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.891Z","timestamp":1784551542891,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=en-us; path=/\nPHPSESSID=6e32224311e99e50533cc77f2fc6320a; expires=Tue, 21-Jul-2026 12:45:43 GMT; Max-Age=86400; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5016\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":28843,"size_decoded":5585,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"bfc33702e4750e82bb1e19331d7a9650","sha1":"2e79668361c5a88e16f5f58dbb484dae059e490f","sha256":"eae8e5333c034957f87845dcd8240a9bdd44ad257a801d41352f0c51ae9bd350","sha512":"fe7ef2fa2080ff58d483c1d8556f98ce00c6aee9e6aa56a80a442ff1975423c379112fc37c712b55f3b27501d86eb8bf93ed5aa5687a73ab5ed2bd21157e31c6","ssdeep":"768:71EAAv/VpW1kxlEPK9eMrXd2xXrK1UUHpUB0F:mi1krEPK9eMrXd2xXrK1UUHp9","tlshash":"6cd2f0278ac4f2619873a455db635f14eed7006793926090ba8fcf8b4fb0c24ce9794e","first_seen":"2026-07-20T12:46:21.20835Z","last_seen":"2026-07-20T12:46:21.20835Z","times_seen":1,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T12:45:41.494Z","timestamp":1784551541494,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5 HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nlocation: https://ht1.ht.htamzoj.icu/h5/\r\ncontent-length: 307\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Mon, 20 Jul 2026 12:45:41 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T17:24:28.523367Z","times_seen":17427003,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu/h5/static/images/customer.png","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.952Z","timestamp":1784551542952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"GET /h5/static/images/customer.png HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 26 Dec 2025 18:28:04 GMT\r\netag: \"22c1-646df0dde6bc7\"\r\naccept-ranges: bytes\r\ncontent-length: 8897\r\ncontent-type: image/png\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":8897,"size_decoded":9128,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"09fc3585c3404a3d53d4186fcaddada0","sha1":"a3c7339d0925b0bcccabb92517814ea6fb363363","sha256":"24175161f75433a7a737bfcb91f840265b6d362a349fcc7e0ffe676474cec059","sha512":"25b21faa9b5f3eb5d4fcd1c703778232cde7573364f3add02b4e79542f842eaca35445084d6a003a3e68c2efce5e0e52816db9efcee5a97a18ecb1ee6a919fb3","ssdeep":"192:H5P30DiESIrJva6WRjoz2RbjD5CYG05TXScGYbyHlLU+GUUIQu3ynrk:H1miEztar5D515TzOHxUId3sk","tlshash":"cc028e228ecf3d0b3c0ef54370fac2339eb751d19855e96559edc91a02321e12d8d1aa","first_seen":"2023-07-15T20:06:17Z","last_seen":"2026-07-21T17:16:44.527976Z","times_seen":65,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu//index/index?lang=en","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ht1.ht.htamzoj.icu/h5/","date":"2026-07-20T12:45:42.911Z","timestamp":1784551542911,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 13:13:46 GMT","end":"Wed, 14 Oct 2026 13:13:45 GMT"},"fingerprint":{"sha1":"1A:1B:95:DD:AD:CB:ED:61:8A:87:25:61:5C:41:C2:CF:B2:C5:F1:5E","sha256":"ED:10:A7:F5:E4:5B:D1:A8:27:72:00:4F:C3:3E:37:FD:32:FD:E3:3A:B3:D8:5C:E3:37:60:1A:29:F1:98:F3:20"}}},"request":{"raw":"POST //index/index?lang=en HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ht1.ht.htamzoj.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ht1.ht.htamzoj.icu/h5/\r\nCookie: think_lang=en-us; PHPSESSID=6e32224311e99e50533cc77f2fc6320a\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=en; path=/\nthink_var=en; path=/\r\nvary: Authorization,Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 590\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 20 Jul 2026 12:45:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2912,"size_decoded":1092,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8c723051c2d9c700d27ebabfe790bd84","sha1":"768ae08dfc14f6aa0e6b09a27a9db9d4fc197ab6","sha256":"cd11150869b65e63fa5d1249c71dcb40c68123e4098d67dfd548ab701ff141c0","sha512":"906fade66b27ce6d680dd7cd9a74237b3b2256973ae01535ea5890228cd401b88b386782c348b40775a23b867580c1e62626336c224ba95ae7b01f560a54f6d0","ssdeep":"","tlshash":"2d51de3ed1426d6ff970a4d4d44ba7c7bdeaa41d86c0dfc403a67b13076d62e0d42622","first_seen":"2026-07-20T12:46:21.213071Z","last_seen":"2026-07-20T12:46:21.213071Z","times_seen":1,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"ht1.ht.htamzoj.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"ht1.ht.htamzoj.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}}]}