{"report_id":"2a2d5035-a09e-49b9-9a32-4b89b53eeb34","version":0,"status":"done","tags":[],"date":"2026-07-14T11:52:07Z","url":{"schema":"http","addr":"blackcatpayments.com","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"ip":{"addr":"104.21.60.156","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"blackcatpayments.com/","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"title":"blackcatpayments.com/","dom":{"size":4442,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4441), with no line terminators","md5":"044b791ba48ce4d640f93c51250030b4","sha1":"e31de47eec80119144eec9d8cbf57b61bbfb1771","sha256":"f8b386448e9a7b98bd78874093a163eafce1286154d7b9ef04db8f10604ac42c","sha512":"2eede5d085f5e498f765eb20d0540b06d29ce68054ba76809a81d38c03fa9f44a80f66d3bb0f4a9106df0c7b99113948f9302f75c41a7c22773ce9ae4017965f","ssdeep":"96:HAm4P4lnFj5OTMaST2y3xST2iQSTYM+STCs:D4P4lnFjaQhARL9","tlshash":"e791ee70a0e00877487f9ed270f8ab9970d2c11edc411047bea9076e6bfac72749d69e","dom_hash":"domhash778874ab30ffdff96293ec0c80bb852b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"blackcatpayments.com","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"ip":{"addr":"104.21.60.156","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T11:52:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"blackcatpayments.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"blackcatpayments.com","ip":{"addr":"104.21.60.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-11","domain_rank":0,"first_seen":"2026-07-14T09:59:35.81059Z","last_seen":"2026-07-14T09:59:35.81059Z","alert_count":3,"request_count":3,"received_data":4842,"sent_data":1485,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":[{"level":"log","text":"Data available from the console:\n\n$json.data - The parsed JSON object\n$json.text - The original JSON text\n$json.headers - HTTP request and response headers\n\nThe JSON Viewer is documented here:\nhttps://firefox-source-docs.mozilla.org/devtools-user/json_viewer/","filename":"resource://devtools/client/jsonview/json-viewer.mjs","line_number":383,"column_number":13}]},"http":[{"url":{"schema":"https","addr":"blackcatpayments.com/","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"ip":{"addr":"104.21.60.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T11:51:40.814Z","timestamp":1784029900814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blackcatpayments.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 19:46:27 GMT","end":"Fri, 09 Oct 2026 20:45:13 GMT"},"fingerprint":{"sha1":"FE:2F:21:13:18:19:1D:F2:68:14:45:61:EE:FE:05:F5:08:7E:25:F7","sha256":"64:B9:F5:3B:48:E9:D8:7D:4C:EB:B3:0F:07:DD:C5:63:36:0B:30:63:B2:1F:AE:C6:9F:66:79:F4:58:DB:F0:74"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: blackcatpayments.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 11:51:40 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UtHAm4LJVR8Z0Qn4Cwp7g66Z3pmETJLxY3lhnMakOIcF8KQC9%2FfnyLIW%2F9vCjMpCQBMswQ%2BP2LY%2FXuwym8JJ9mtBAONhvOZfr0dNqdlb%2B9TG2DtwiRS9C0HTnPUu0240BDD3j6zGzA%3D%3D\"}]}\r\ncontent-security-policy: default-src 'self';script-src 'self' 'unsafe-inline' https://unpkg.com https://cdnjs.cloudflare.com;script-src-attr 'unsafe-inline';style-src 'self' 'unsafe-inline' https://unpkg.com https://fonts.googleapis.com https://cdnjs.cloudflare.com;font-src 'self' https://fonts.gstatic.com;img-src 'self' data: https:;connect-src 'self';base-uri 'self';form-action 'self';frame-ancestors 'self';object-src 'none';upgrade-insecure-requests\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: cross-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: DENY\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\netag: W/\"5a-Nw5dGwuFx/BP8xKL1Efj3PnTv5Q\"\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a1b051203b3956a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90,"size_decoded":1640,"mime_type":"application/vnd.mozilla.json.view; charset=utf-8","magic":"JSON text data","md5":"c9aa64f36b6821e54d69fb1316d6b859","sha1":"1a4eb13c97586251ab69758f3fb68cc142c8f1cc","sha256":"0972a6e026533465e59e241d03905d6c55e15ae253054722ff877f12988e5eac","sha512":"636e9a9cc3c8fbad31f1421f26853e0055fa460cca068035083ee2f521c242d57d60dda85ebb612e2764578132baa021505850a49e6af6badd5d5b2d395b734e","ssdeep":"","tlshash":"0bb0120903196d5517954450300da6144253f001c5823885c5ad10385184184147301c","first_seen":"2026-07-14T09:59:37.918739Z","last_seen":"2026-07-14T11:52:07.347271Z","times_seen":2,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":5,"connect":15,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"blackcatpayments.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blackcatpayments.com/","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"ip":{"addr":"104.21.60.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T11:51:41.103Z","timestamp":1784029901103,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blackcatpayments.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 19:46:27 GMT","end":"Fri, 09 Oct 2026 20:45:13 GMT"},"fingerprint":{"sha1":"FE:2F:21:13:18:19:1D:F2:68:14:45:61:EE:FE:05:F5:08:7E:25:F7","sha256":"64:B9:F5:3B:48:E9:D8:7D:4C:EB:B3:0F:07:DD:C5:63:36:0B:30:63:B2:1F:AE:C6:9F:66:79:F4:58:DB:F0:74"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: blackcatpayments.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 11:51:41 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tz0h8JRMAPepAwhMUIFETEbfjninc1bJaK5T6s2hKVKB8spCDXaukZAf3bhn%2B8PRWFND87%2Flg6AXxrDgk6SAiCTpvi447lKpSs%2FG0DUCsfs3WpuFxnUzNXMwGduIatmguVXal98s5g%3D%3D\"}]}\r\ncontent-security-policy: default-src 'self';script-src 'self' 'unsafe-inline' https://unpkg.com https://cdnjs.cloudflare.com;script-src-attr 'unsafe-inline';style-src 'self' 'unsafe-inline' https://unpkg.com https://fonts.googleapis.com https://cdnjs.cloudflare.com;font-src 'self' https://fonts.gstatic.com;img-src 'self' data: https:;connect-src 'self';base-uri 'self';form-action 'self';frame-ancestors 'self';object-src 'none';upgrade-insecure-requests\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: cross-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: DENY\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\netag: W/\"5a-Nw5dGwuFx/BP8xKL1Efj3PnTv5Q\"\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a1b05121db4d56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":90,"size_decoded":1636,"mime_type":"application/vnd.mozilla.json.view; charset=utf-8","magic":"JSON text data","md5":"c9aa64f36b6821e54d69fb1316d6b859","sha1":"1a4eb13c97586251ab69758f3fb68cc142c8f1cc","sha256":"0972a6e026533465e59e241d03905d6c55e15ae253054722ff877f12988e5eac","sha512":"636e9a9cc3c8fbad31f1421f26853e0055fa460cca068035083ee2f521c242d57d60dda85ebb612e2764578132baa021505850a49e6af6badd5d5b2d395b734e","ssdeep":"","tlshash":"0bb0120903196d5517954450300da6144253f001c5823885c5ad10385184184147301c","first_seen":"2026-07-14T09:59:37.918739Z","last_seen":"2026-07-14T11:52:07.347271Z","times_seen":2,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"blackcatpayments.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blackcatpayments.com/favicon.ico","fqdn":"blackcatpayments.com","domain":"blackcatpayments.com","tld":"com"},"ip":{"addr":"104.21.60.156","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"resource://devtools/client/jsonview/","date":"2026-07-14T11:51:41.563Z","timestamp":1784029901563,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blackcatpayments.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 11 Jul 2026 19:46:27 GMT","end":"Fri, 09 Oct 2026 20:45:13 GMT"},"fingerprint":{"sha1":"FE:2F:21:13:18:19:1D:F2:68:14:45:61:EE:FE:05:F5:08:7E:25:F7","sha256":"64:B9:F5:3B:48:E9:D8:7D:4C:EB:B3:0F:07:DD:C5:63:36:0B:30:63:B2:1F:AE:C6:9F:66:79:F4:58:DB:F0:74"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: blackcatpayments.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Tue, 14 Jul 2026 11:51:41 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Glw%2Fa%2FYYH2Vgl5od70SlxL4KOPQ%2Be%2BaSp8BaN%2BRNXJ37P0kQi%2BSwSyWZsA7V%2B9h%2BxAzp9%2FycFhX70lkuCgPZaFJD%2F3Elqr99D5WtHmE3ofWEhFim5Mxc5SW3a2pnYZxY8Qo1zBKhpg%3D%3D\"}]}\r\ncontent-security-policy: default-src 'self';script-src 'self' 'unsafe-inline' https://unpkg.com https://cdnjs.cloudflare.com;script-src-attr 'unsafe-inline';style-src 'self' 'unsafe-inline' https://unpkg.com https://fonts.googleapis.com https://cdnjs.cloudflare.com;font-src 'self' https://fonts.gstatic.com;img-src 'self' data: https:;connect-src 'self';base-uri 'self';form-action 'self';frame-ancestors 'self';object-src 'none';upgrade-insecure-requests\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: cross-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: DENY\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\netag: W/\"5a-Nw5dGwuFx/BP8xKL1Efj3PnTv5Q\"\r\npriority: u=6,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a1b05124db0a0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-20T20:25:15.751278Z","times_seen":17402670,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"blackcatpayments.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}