{"report_id":"069356e8-0b7e-4321-b5e8-384be935a884","version":0,"status":"done","tags":[],"date":"2026-07-25T22:18:09Z","url":{"schema":"http","addr":"cakepay.site","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"ip":{"addr":"178.16.53.154","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"cakepay.site/","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"title":"Cake Pay | CakePay Gift Cards, Crypto Spending \u0026 Privacy","dom":{"size":16471,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (397)","md5":"4068d46ede5af15573cd380455e6fdd6","sha1":"b58ee0bb2e4e22324b8f87c19f1736d93ce87e3d","sha256":"a80cfea0d6efeeb9397a521bf0a8122fd985c8e5557ffeda5e50167931b4ed60","sha512":"bd12a3768a1521f7d424e2602540ed788b3db4457f862fefa651a93931a4bed6a0914735e16ffe2e927331a189e2631ce24e911fc343629e396f106dc68246ab","ssdeep":"192:hRV86d/Yd38knus81G0c5/ouusvH+vHlMyFVyf8JyCWlyLIIeJ+xmDtmATacWxIS:hRG6d/Ydsknuf1+sxIIeJiATajIqfKI","tlshash":"b772612291f06a73539751a0b7b6232afe92901bd69d2c42b7ad87de5fd8f43843310d","dom_hash":"domhash792f4e90086c9bcba5945350130ba72e","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cakepay.site","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"ip":{"addr":"178.16.53.154","port":0,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-29T22:18:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"cakepay.site","ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-05-25","domain_rank":0,"first_seen":"2026-07-25T22:11:31.889795Z","last_seen":"2026-07-25T22:11:31.889795Z","alert_count":9,"request_count":3,"received_data":29579,"sent_data":1986,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.3.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cakepay.site/favicon.ico","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cakepay.site/","date":"2026-07-25T22:17:43.206Z","timestamp":1785017863206,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cakepay.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Jul 2026 02:05:38 GMT","end":"Fri, 23 Oct 2026 02:05:37 GMT"},"fingerprint":{"sha1":"92:5B:1E:5F:3C:2C:89:1D:5A:65:0B:31:38:50:7C:D2:38:AA:2D:5A","sha256":"50:3A:6D:E3:53:B6:A2:DF:23:E6:4D:8F:AC:9C:59:D6:E1:49:5A:08:1D:C7:DE:6B:01:FE:AE:7C:50:09:8B:9E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cakepay.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cakepay.site/\r\nCookie: sess=eyJpdiI6ImpIVzFhVDNoL3VLR0NSWlIwUzBOa2c9PSIsInZhbHVlIjoiUzFWYWI3dlRUcWdCZFQ0QmlkYnRJOTRlL3AvMkpETEc5RXg4WkNUQUZiUE5hK05BNVpiNDRURm5jSVZwRmZEOSIsIm1hYyI6IjMwYWU5NGU5ZWFmNzBiYzMzYzU0NGM5YTc3ZmVjNzNhODNiNmU3ZmRkMTM2MTM0NzA3Mjc5N2QzNmViZDViODQiLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sat, 25 Jul 2026 22:17:43 GMT\r\nContent-Type: image/vnd.microsoft.icon\r\nContent-Length: 2370\r\nConnection: keep-alive\r\nLast-Modified: Mon, 25 May 2026 22:49:03 GMT\r\nETag: \"942-652ac2f6c83c7\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2370,"size_decoded":2629,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 48x48 with PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"31e770b1cd8923d05ff1f8c06c650335","sha1":"13b1aabc3e6b279fc1e5abe85b072d18ab4826db","sha256":"6b1a9d3f721ba910a87c9037c5186a87a147bfca4c111720c0ad57a237e93334","sha512":"7cfe6bd24764c1168491fe6d52a9dc87006ccb275c1a51796603d9715e778711b59c9286543c416dc2640ac3ae9b31c55124d91b8aa33ed47cd2ba42dba532d4","ssdeep":"","tlshash":"02414dd87420c7a2e4bc31ec3916438a8d9aa580a19ffb4b0206e5e0f295769a720372","first_seen":"2026-07-25T22:11:34.827892Z","last_seen":"2026-07-25T22:19:06.979046Z","times_seen":4,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cakepay.site/","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-25T22:17:42.089Z","timestamp":1785017862089,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cakepay.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Jul 2026 02:05:38 GMT","end":"Fri, 23 Oct 2026 02:05:37 GMT"},"fingerprint":{"sha1":"92:5B:1E:5F:3C:2C:89:1D:5A:65:0B:31:38:50:7C:D2:38:AA:2D:5A","sha256":"50:3A:6D:E3:53:B6:A2:DF:23:E6:4D:8F:AC:9C:59:D6:E1:49:5A:08:1D:C7:DE:6B:01:FE:AE:7C:50:09:8B:9E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cakepay.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sat, 25 Jul 2026 22:17:42 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/8.3.24\r\nSet-Cookie: sess=eyJpdiI6ImpIVzFhVDNoL3VLR0NSWlIwUzBOa2c9PSIsInZhbHVlIjoiUzFWYWI3dlRUcWdCZFQ0QmlkYnRJOTRlL3AvMkpETEc5RXg4WkNUQUZiUE5hK05BNVpiNDRURm5jSVZwRmZEOSIsIm1hYyI6IjMwYWU5NGU5ZWFmNzBiYzMzYzU0NGM5YTc3ZmVjNzNhODNiNmU3ZmRkMTM2MTM0NzA3Mjc5N2QzNmViZDViODQiLCJ0YWciOiIifQ%3D%3D; expires=Tue, 22 Jul 2036 22:17:42 GMT; Max-Age=315360000\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16488,"size_decoded":3985,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (397)","md5":"e915ed54562d7e75e3d921b05344abcc","sha1":"ced93e4b218e39d7122594386ea6dd6f4149afe9","sha256":"fa10ba76319ed2e633833ac39f7673118616041c1f2257d414f9d961f57f58fa","sha512":"d6f5a8daf40ad8c185acce6bb1ddfa91d99836de1173af9a2bb05040868c37999155aa7f60b43a28db021ec8e185ecce5164705ba1c72a2a11aa799da7b25a1c","ssdeep":"192:vRV86d/Yd38knus81G0c5/ouusvH+vHlMyFVyf8JyCWlyLIIeJ+xmDtmATacWxIg:vRG6d/Ydsknuf1+sxIIeJiATajIqfKm","tlshash":"1672622291f05a73539751a0b7b6232afe92901bd69d2c42b7ad87de5fd8f43843310d","first_seen":"2026-07-25T22:11:34.825477Z","last_seen":"2026-07-25T22:19:06.980001Z","times_seen":4,"resource_available":true,"data":null}},"time_used":887,"timings":{"blocked":-1,"dns":88,"connect":61,"send":0,"wait":668,"receive":0,"ssl":70},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cakepay.site/assets/styles.css","fqdn":"cakepay.site","domain":"cakepay.site","tld":"site"},"ip":{"addr":"178.16.53.154","port":443,"asn":40999,"as":"dus.net GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cakepay.site/","date":"2026-07-25T22:17:43.139Z","timestamp":1785017863139,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cakepay.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Jul 2026 02:05:38 GMT","end":"Fri, 23 Oct 2026 02:05:37 GMT"},"fingerprint":{"sha1":"92:5B:1E:5F:3C:2C:89:1D:5A:65:0B:31:38:50:7C:D2:38:AA:2D:5A","sha256":"50:3A:6D:E3:53:B6:A2:DF:23:E6:4D:8F:AC:9C:59:D6:E1:49:5A:08:1D:C7:DE:6B:01:FE:AE:7C:50:09:8B:9E"}}},"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: cakepay.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cakepay.site/\r\nCookie: sess=eyJpdiI6ImpIVzFhVDNoL3VLR0NSWlIwUzBOa2c9PSIsInZhbHVlIjoiUzFWYWI3dlRUcWdCZFQ0QmlkYnRJOTRlL3AvMkpETEc5RXg4WkNUQUZiUE5hK05BNVpiNDRURm5jSVZwRmZEOSIsIm1hYyI6IjMwYWU5NGU5ZWFmNzBiYzMzYzU0NGM5YTc3ZmVjNzNhODNiNmU3ZmRkMTM2MTM0NzA3Mjc5N2QzNmViZDViODQiLCJ0YWciOiIifQ%3D%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.26.3\r\nDate: Sat, 25 Jul 2026 22:17:43 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 30 Jun 2026 19:02:01 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a4412a9-2559\"\r\nExpires: Sun, 26 Jul 2026 22:17:43 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9561,"size_decoded":2875,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"d32e6f6fb3f0e5db94ef887c02ae9c70","sha1":"f39f3270c8db0ba779f4c9ee61e5e745fd12fd98","sha256":"b5db541c17851b15c6510ed1bc1246fe935a477588120d19fd04a337f07e7d99","sha512":"408462590ff91582f3cb8924fd41cf407a69b1f829ff009f27450682c951a05be7a7064fc0d73d10d98d0c7856cfeac6f01a22fbf4d3bb2fd2d0cbda477c0703","ssdeep":"192:KEttRnm+igDMHJyYtLUj/2Tg/osP+PCdojPaXGcreCYtiKM8T:hDPeCebCWrTew","tlshash":"be1235c29bf45a14b56f90e4e9d79f45b37dc047800eceb85be8206cbe8c2d99572e09","first_seen":"2026-07-25T22:11:34.826606Z","last_seen":"2026-07-25T22:19:06.980725Z","times_seen":4,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-25","alert":"Sinkholed","trigger":"cakepay.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}