{"report_id":"f59a3b0a-c492-4b4e-967f-f1ad83fa37ee","version":6,"status":"done","tags":["amazon","phishing"],"date":"2026-01-04T07:26:26Z","url":{"schema":"https","addr":"amzuu.icu/h5/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":0,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"amzuu.icu/h5/#/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"title":"Amazon","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T23:53:57.491187Z","times_seen":17862611,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"amzuu.icu/h5/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":0,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-08T07:26:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-04T07:26:06Z","timestamp":1767511566,"ip_dst":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.11","port":33676,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-01-04T07:26:06.347922+0000\",\"flow_id\":1740984690830451,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.11\",\"src_port\":33676,\"dest_ip\":\"154.92.22.53\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"amzuu.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":911,\"bytes_toclient\":3480,\"start\":\"2026-01-04T07:26:06.158835+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"summary":[{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"118.25.42.241","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2025-12-29T10:40:39.031637Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"amzuu.icu","ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":50,"request_count":10,"received_data":1375614,"sent_data":4469,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"ht1.ht.htamzoj.icu","ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-12-23","domain_rank":0,"first_seen":"2026-01-04T07:26:27.291285Z","last_seen":"2026-01-04T07:26:27.291285Z","alert_count":0,"request_count":2,"received_data":3794,"sent_data":1058,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"amzuu.icu/h5/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-08-12T17:56:53.44404Z","times_seen":7175,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/chunk-vendors.d47216be.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"95dd52ada79faef0d90a59d71dc57410","sha1":"a5bd7bc5a7d9aceb7468e792e8e0457a341763e8","sha256":"5713e4b536cc7d4164de7915effe662e2fa24feb318473941d07e715724c7b8f","sha512":"4d3e068169e54265c08287d99b8dacf0ecd38bd906d01437c0f4f25789ba2b5375b0b410a48cb7769db69a165a599f267ba12ce5f327eb715b633ddc9b21805e","ssdeep":"6144:aVMwTfmVKb/eSbfLNHzzY3vm7UQeXhN+jvHzLPNZ/bYaQF2dePerr7fnF64iXcOp:aewTOdSjLhIFQ9vHzDz3JBr3nE8Oj5G2","tlshash":"0715088df285b0b51be760b5403f220bb2377969b40a84d4f675e4d4ad78a4e2227f3d","size":903122,"data":"","first_seen":"2025-11-09T12:54:48.405097Z","last_seen":"2026-07-20T15:45:09.055803Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/index.6dfeb497.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8760037379ce785c447970b326eb4d1","sha1":"3d3dafa38cfa9a4c5b8e65bc9ee53fae2af025f3","sha256":"0c20442228af927a31902a918012a79880792a76d55f44661855aa816d09ef56","sha512":"2d8c8235224300cadd40746b0ee88305caafe949d69fe7d620ba909cb732e57ba5dc8002e023df71000cf7723dc4abe224320b7478cf0057d0e1ef4507ace2e1","ssdeep":"3072:+G0fHY7oaCIbWEQeCoxaGuM9bl+U05lKXxBxz7Dg:AfHKoaChEQToB7U","tlshash":"5534f9c2b6c9103e8f831f85d06b36fcf6bb1c638149e4c7e5d17fb95a99986120a61c","size":243584,"data":"","first_seen":"2026-01-03T19:07:01.390561Z","last_seen":"2026-07-20T15:45:09.058815Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/pages-home-index.1fa7dcd1.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d2685b69f2cefcdef7367479137a2da3","sha1":"c241addccd2063d38847fa42d098042b33f5326b","sha256":"bf5c54c29dd672082330f67cdef62946b3372a72a020e8049170917157dd7e25","sha512":"a8849f7c7d2be03cca9d6afb0eb6003887ea43f204d7642f4d52a78a770d70a2673376648396a8518c7437c30de752b9199cad2e9933c539fa6d5c58ed9a3626","ssdeep":"768:7NGElnwLeu/xF/vfcijS/TNUppy5pUOmQ4ikGfr6NVBDVw:kElwLeu/xF3f65SOwibfr6NBw","tlshash":"8013cf3660d7b8ef8e936a41b01757199cbd3e5bf514f0c21b64dee0c5e0a0b351aa98","size":41456,"data":"","first_seen":"2026-01-03T19:07:01.388005Z","last_seen":"2026-07-20T15:45:09.054281Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f733d571164cea4063895fccaf3a3f91","sha1":"c6b846e94da54056235f76d96afe96566edcd551","sha256":"6027f911d1f38fc6f9c725f92107d0e5583ffb89f01af79c22b12fceb412bd56","sha512":"6190b2cc65459140101bcc8bb857a1e1b34e0b1956eacdefee40a22836b05dc6a24dcbef9bc5b6e6de3f407b30640c8241e880c6edb1b518ee160bf2be11c9e3","ssdeep":"384:DCm9GCDeq4zhMBwoJ0ihWGPtHU9A8SPNknxZxndGX9ascem9Fsi:Dj4CDeRh4x0ihjPtHU9A8SPNknxZxd82","tlshash":"9ba2f616b0c7e4a70e93586415ab520a90337e5c8825f5d5e7b1b6fa0cf6e8f131af2c","size":23149,"data":"","first_seen":"2025-11-09T12:54:48.40729Z","last_seen":"2026-07-20T15:45:09.063112Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"amzuu.icu/h5/static/index.2da1efab.css","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:08.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/index.2da1efab.css HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:08 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:02 GMT\r\netag: \"178f9-646df0dbc0eb1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 26185\r\ncontent-type: text/css\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":96505,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"73ae6c583d02d78f81e3f18860a2899a","sha1":"07df9233fc11dddc34fbf519b891d40b2ac29c0f","sha256":"e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83","sha512":"da54ba9dbe06d8d763f3cfd64cf5babb54e761e3208c7a2f23e845290c48db8c115bb86c24262cd6c9a96ff2e51674c6d86439e1814baf2de7980f5c06349921","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nKhlvbc:VApuK7hmVrS1Wu3iG41nKPI","tlshash":"1893f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2024-01-02T00:07:11Z","last_seen":"2026-08-12T15:08:34.132264Z","times_seen":6428,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/chunk-vendors.d47216be.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:08.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.d47216be.js HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:08 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:08 GMT\r\netag: \"dc7d2-646df0e1867e1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":903122,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64698), with no line terminators","md5":"95dd52ada79faef0d90a59d71dc57410","sha1":"a5bd7bc5a7d9aceb7468e792e8e0457a341763e8","sha256":"5713e4b536cc7d4164de7915effe662e2fa24feb318473941d07e715724c7b8f","sha512":"4d3e068169e54265c08287d99b8dacf0ecd38bd906d01437c0f4f25789ba2b5375b0b410a48cb7769db69a165a599f267ba12ce5f327eb715b633ddc9b21805e","ssdeep":"6144:aVMwTfmVKb/eSbfLNHzzY3vm7UQeXhN+jvHzLPNZ/bYaQF2dePerr7fnF64iXcOp:aewTOdSjLhIFQ9vHzDz3JBr3nE8Oj5G2","tlshash":"0715088df285b0b51be760b5403f220bb2377969b40a84d4f675e4d4ad78a4e2227f3d","first_seen":"2025-11-09T12:54:48.405097Z","last_seen":"2026-07-20T15:45:09.055803Z","times_seen":31,"resource_available":true,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/index.6dfeb497.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:08.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/js/index.6dfeb497.js HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:08 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:09 GMT\r\netag: \"3b780-646df0e28949b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":243584,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63692), with no line terminators","md5":"b8760037379ce785c447970b326eb4d1","sha1":"3d3dafa38cfa9a4c5b8e65bc9ee53fae2af025f3","sha256":"0c20442228af927a31902a918012a79880792a76d55f44661855aa816d09ef56","sha512":"2d8c8235224300cadd40746b0ee88305caafe949d69fe7d620ba909cb732e57ba5dc8002e023df71000cf7723dc4abe224320b7478cf0057d0e1ef4507ace2e1","ssdeep":"3072:+G0fHY7oaCIbWEQeCoxaGuM9bl+U05lKXxBxz7Dg:AfHKoaChEQToB7U","tlshash":"5534f9c2b6c9103e8f831f85d06b36fcf6bb1c638149e4c7e5d17fb95a99986120a61c","first_seen":"2026-01-03T19:07:01.390561Z","last_seen":"2026-07-20T15:45:09.058815Z","times_seen":16,"resource_available":true,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/assets/6666.aebcf570.jpg","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:09.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/assets/6666.aebcf570.jpg HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:09 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:27:53 GMT\r\netag: \"6f83-646df0d2da8b2\"\r\naccept-ranges: bytes\r\ncontent-length: 28547\r\ncontent-type: image/jpeg\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":28547,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1000x666, components 3","md5":"aebcf5704aff5247b07b2528e88cdaeb","sha1":"2443ff609d60b212a5b7fb49001a6d72425e50f3","sha256":"fe62ae947000f17c9b806ee886214dab6a6c0b7d3d02132cf54f75ab089cd232","sha512":"52096f63401845c4cfa18398a7a5960dbbb4ce423964549e715be49d128a4868ba0385cdb391458abac3c50f4dbef42415ee2bd7ff4568f338ffc0a10a626769","ssdeep":"384:k9mGOxf70wvhhFDRi17+c4RKZJZmih/88T+UerDcZRX19TS43CoZyGEByv:bDbn/ER4wZVh/VTcQZX9Tx3CoZY8","tlshash":"95d2dfffcb4e6587e85857b2e2c2b603f1437e0056ea653acf404b096e8eac16d74344","first_seen":"2025-12-02T02:35:09.228696Z","last_seen":"2026-07-20T15:45:09.052001Z","times_seen":28,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-04T07:26:07.650Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:07 GMT\r\nserver: Apache\r\nlast-modified: Sun, 28 Dec 2025 15:11:27 GMT\r\netag: \"323-647048a6851e0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 492\r\ncontent-type: text/html\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":803,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (519), with CRLF line terminators","md5":"6af68b689ca91705242083729515fed9","sha1":"85481a12e8a09138ec3efd50e5ad671feb7115b3","sha256":"c4b2205c1a4254e266fa220481fb376fbb468c6d5f253cb0ff9de1b4cfee7fc4","sha512":"cedca7cec6eb2f3b18218964627700fdb6b039a3f98996a75bbc000c84f25d9cb62ca7003795d6789f9d8bcd2ccb71802a972f452655407c9a077f334c72b8fd","ssdeep":"","tlshash":"0401cec25c21a04d1720865174b6e11e4ada45b9a991cd1178ac26ed4bf0b8edd6f810","first_seen":"2026-01-03T19:07:01.380806Z","last_seen":"2026-07-20T15:45:09.050195Z","times_seen":16,"resource_available":true,"data":null}},"time_used":488,"timings":{"blocked":197,"dns":1,"connect":93,"send":0,"wait":94,"receive":0,"ssl":99},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/pages-home-index.1fa7dcd1.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:08.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/js/pages-home-index.1fa7dcd1.js HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:08 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:21 GMT\r\netag: \"a1f0-646df0ee1857c-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 25026\r\ncontent-type: text/javascript\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41456,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40942), with no line terminators","md5":"d2685b69f2cefcdef7367479137a2da3","sha1":"c241addccd2063d38847fa42d098042b33f5326b","sha256":"bf5c54c29dd672082330f67cdef62946b3372a72a020e8049170917157dd7e25","sha512":"a8849f7c7d2be03cca9d6afb0eb6003887ea43f204d7642f4d52a78a770d70a2673376648396a8518c7437c30de752b9199cad2e9933c539fa6d5c58ed9a3626","ssdeep":"768:7NGElnwLeu/xF/vfcijS/TNUppy5pUOmQ4ikGfr6NVBDVw:kElwLeu/xF3f65SOwibfr6NBw","tlshash":"8013cf3660d7b8ef8e936a41b01757199cbd3e5bf514f0c21b64dee0c5e0a0b351aa98","first_seen":"2026-01-03T19:07:01.388005Z","last_seen":"2026-07-20T15:45:09.054281Z","times_seen":16,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":96,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/images/customer.png","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:09.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/images/customer.png HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:09 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:04 GMT\r\netag: \"22c1-646df0dde6bc7\"\r\naccept-ranges: bytes\r\ncontent-length: 8897\r\ncontent-type: image/png\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":8897,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"09fc3585c3404a3d53d4186fcaddada0","sha1":"a3c7339d0925b0bcccabb92517814ea6fb363363","sha256":"24175161f75433a7a737bfcb91f840265b6d362a349fcc7e0ffe676474cec059","sha512":"25b21faa9b5f3eb5d4fcd1c703778232cde7573364f3add02b4e79542f842eaca35445084d6a003a3e68c2efce5e0e52816db9efcee5a97a18ecb1ee6a919fb3","ssdeep":"192:H5P30DiESIrJva6WRjoz2RbjD5CYG05TXScGYbyHlLU+GUUIQu3ynrk:H1miEztar5D515TzOHxUId3sk","tlshash":"cc028e228ecf3d0b3c0ef54370fac2339eb751d19855e96559edc91a02321e12d8d1aa","first_seen":"2023-07-15T20:06:17Z","last_seen":"2026-07-25T17:41:51.320889Z","times_seen":69,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu//index/index?lang=en","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:09.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Dec 2025 16:43:14 GMT","end":"Thu, 26 Mar 2026 16:43:13 GMT"},"fingerprint":{"sha1":"4F:C9:65:EB:DE:4B:F1:51:75:BC:F8:13:5C:60:18:F4:BF:37:BC:EA","sha256":"DB:CB:7C:D6:DB:B6:44:7F:56:79:5B:2E:A0:91:F2:DF:C8:87:46:E6:61:9A:9D:8F:46:B6:4F:4E:5E:1E:C8:F8"}}},"request":{"raw":"POST //index/index?lang=en HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://amzuu.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=en; path=/\nthink_var=en; path=/\r\nvary: Authorization,Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 587\r\ncontent-type: application/json; charset=utf-8\r\ndate: Sun, 04 Jan 2026 07:26:09 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2912,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"90111803fe2399bf7db889333fc4da5d","sha1":"87dcadaddeaeacce0c44b07747e2f90f2e5e5295","sha256":"543d77e21126e38260571052bfaed4287d1150e44f5708d8f827d9f68d1fd4d0","sha512":"53bde7d465082b2b7320a6323190554847349af59a9ce40530120c22df3ec6fa222c935724a1a58043aaf24eebe16e6ed1a9abc2333629628ca74338d334a762","ssdeep":"","tlshash":"8b51bc3ed0026d6ff970a5d4c54ba7c7bde6a42d96c0dfc403aa3b12036e62e0d46662","first_seen":"2026-01-04T07:26:35.500006Z","last_seen":"2026-01-04T07:26:35.500006Z","times_seen":1,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"118.25.42.241","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:11.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 04 Jan 2026 07:26:13 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Sun, 04 Jan 2026 15:26:13 GMT\r\ncache-control: max-age=28800\r\nset-cookie: __uni__uid=rBEQMWlaFhUfPVG+A2jyAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-12T17:58:05.004946Z","times_seen":20215,"resource_available":false,"data":null}},"time_used":3563,"timings":{"blocked":1463,"dns":1,"connect":278,"send":0,"wait":637,"receive":0,"ssl":1181},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ht1.ht.htamzoj.icu//index/index?lang=en","fqdn":"ht1.ht.htamzoj.icu","domain":"htamzoj.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:09.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ht1.ht.htamzoj.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Dec 2025 16:43:14 GMT","end":"Thu, 26 Mar 2026 16:43:13 GMT"},"fingerprint":{"sha1":"4F:C9:65:EB:DE:4B:F1:51:75:BC:F8:13:5C:60:18:F4:BF:37:BC:EA","sha256":"DB:CB:7C:D6:DB:B6:44:7F:56:79:5B:2E:A0:91:F2:DF:C8:87:46:E6:61:9A:9D:8F:46:B6:4F:4E:5E:1E:C8:F8"}}},"request":{"raw":"OPTIONS //index/index?lang=en HTTP/1.1\r\nHost: ht1.ht.htamzoj.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://amzuu.icu/\r\nOrigin: https://amzuu.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\ncontent-length: 0\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sun, 04 Jan 2026 07:26:09 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T23:53:57.491187Z","times_seen":17862611,"resource_available":true,"data":null}},"time_used":1352,"timings":{"blocked":606,"dns":408,"connect":92,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amzuu.icu/h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:08.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /h5/static/js/pages-grab-index~pages-home-index.80d7cbc6.js HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 07:26:08 GMT\r\nserver: Apache\r\nlast-modified: Fri, 26 Dec 2025 18:28:20 GMT\r\netag: \"5a6d-646df0ed05ec1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5913\r\ncontent-type: text/javascript\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":23149,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (21115), with no line terminators","md5":"f733d571164cea4063895fccaf3a3f91","sha1":"c6b846e94da54056235f76d96afe96566edcd551","sha256":"6027f911d1f38fc6f9c725f92107d0e5583ffb89f01af79c22b12fceb412bd56","sha512":"6190b2cc65459140101bcc8bb857a1e1b34e0b1956eacdefee40a22836b05dc6a24dcbef9bc5b6e6de3f407b30640c8241e880c6edb1b518ee160bf2be11c9e3","ssdeep":"384:DCm9GCDeq4zhMBwoJ0ihWGPtHU9A8SPNknxZxndGX9ascem9Fsi:Dj4CDeRh4x0ihjPtHU9A8SPNknxZxd82","tlshash":"9ba2f616b0c7e4a70e93586415ab520a90337e5c8825f5d5e7b1b6fa0cf6e8f131af2c","first_seen":"2025-11-09T12:54:48.40729Z","last_seen":"2026-07-20T15:45:09.063112Z","times_seen":31,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":95,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/favicon.ico","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"154.92.22.53","port":443,"asn":138152,"as":"YISU CLOUD LTD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://amzuu.icu/h5/","date":"2026-01-04T07:26:09.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.f2.fx2amuo.site","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Jan 2026 12:38:18 GMT","end":"Wed, 01 Apr 2026 12:38:17 GMT"},"fingerprint":{"sha1":"2A:EB:1B:9B:21:12:3B:00:C9:FB:A1:13:E9:15:17:EB:F0:A3:A7:BF","sha256":"AE:72:AB:F6:50:3D:8B:6F:E7:72:98:27:B7:A7:44:ED:57:0F:51:AB:97:D7:C6:43:8C:7F:07:AA:4D:32:D9:DE"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://amzuu.icu/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Sun, 04 Jan 2026 07:26:09 GMT\r\nserver: Apache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4805\r\ncontent-type: text/html; charset=utf-8\r\nset-cookie: think_lang=en-us; path=/\nPHPSESSID=97a11d29cce3c08f24a634cc53f69096; expires=Mon, 05-Jan-2026 07:26:09 GMT; Max-Age=86400; path=/\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":26813,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators","md5":"93d4848379f23e7b4f1e242d0685db3f","sha1":"f03ca357640f3dd3d5c2d4e05db591077554ed88","sha256":"5162f927ca63a498365cfb3edd1940968f99c2b2a424c1933fdd37631556f1ec","sha512":"387cee78e16272fe2019e2cfe4a2f104b347fb3c445e0c1381143dce86b5783f3d68028c173dced3080312a030c5b38fdbb7c215f0c481ee17b19b6c6d480844","ssdeep":"768:71EAAv/Vp5TYwbCoPK9eMrXd2xXrK1UUHpUB0F:m1TYweoPK9eMrXd2xXrK1UUHp9","tlshash":"22c2241746c4e6a19873a455db634b10fed70067939260a4ba8fcf4b4fb0c25ce97d4e","first_seen":"2026-01-04T07:26:35.50349Z","last_seen":"2026-01-04T07:26:35.50349Z","times_seen":1,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"amzuu.icu/h5/","fqdn":"amzuu.icu","domain":"amzuu.icu","tld":"icu"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-04T07:26:03.368Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: amzuu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T23:53:57.491187Z","times_seen":17862611,"resource_available":true,"data":null}},"time_used":2983,"timings":{"blocked":2983,"dns":0,"connect":92,"send":0,"wait":0,"receive":0,"ssl":99},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-04","alert":"Phishing Block","trigger":"amzuu.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"amzuu.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}}]}