{"report_id":"7f797acb-1af3-4b4d-b360-405e645b8183","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-09-02T17:44:13Z","url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"title":"$CASHCAT — They Called It Cash Cat First","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-03T21:47:53.954795Z","times_seen":18262872,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-07T17:44:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":30}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/338e6e2c2be0cca6-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/e9f67b0a1bfb7388-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/1e6f4a4be8352cbc-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6f2049edee8beeb2-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/27145be036dbd745-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/d3ebbfd689654d3a-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/2caafad0d9e33075-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/d1f93f19f5eb03d0-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/47edecb87d4c975b-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/a51329d32af18bb8-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/3637a1b0f55928bf-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/4c48dfb25870a9fb-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/daa198f43674753e-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/8c14efce11d511c4-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/7f612c65de6e1300-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/98e207f02528a563-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/8fbf8aae21cd9b52-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/3195ddcb8417d111-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/75d0d809d177ae2f-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/2a3b9c9294c3c3e8-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/35731b92a9f1ef9d-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6d7cc3a563fdbe78-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/7e3c9184189bbc0c-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/4b7a4c192ae21457-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6a2969fdad2f04be-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/24f6455c18489ce9-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"cashcat.cc","ip":{"addr":"216.150.1.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-02T17:05:23.453261Z","last_seen":"2026-09-02T17:05:23.453261Z","alert_count":0,"request_count":3,"received_data":140445,"sent_data":1636,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cashscat.cc","ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-02T17:05:23.450112Z","last_seen":"2026-09-02T17:05:23.450112Z","alert_count":139,"request_count":37,"received_data":4920746,"sent_data":21002,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-08-27T08:04:57.286019Z","alert_count":0,"request_count":2,"received_data":741,"sent_data":1165,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ipwho.is","ip":{"addr":"172.66.175.107","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-29","domain_rank":18239,"first_seen":"2020-06-08T11:52:47Z","last_seen":"2026-09-02T03:36:00.046208Z","alert_count":0,"request_count":1,"received_data":944,"sent_data":443,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"md5":"763a233f5ea437b6a02b61608b0f012c","sha1":"1240c4b1d8914fd04ce0f70836768205a37015a5","sha256":"6be291c8fa550034a122fa4871889e0a2ea975e673b2747bd098fc29fecc5cbe","sha512":"4d2f840cf6a29c696d75505d27ae444aee0fb0d29ac121f841a656f62b407d9d89cc6418d6e72673778fbffb14134d8df742c3811d7d17047fbf2009e54cdc23","size":4306,"token":"8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys","is_revoked":false,"bot":{"token":"8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys","user_id":"8654402884","username":"linkapprovalbot","first_name":"Approval","last_name":"","chat":{"chat_id":"","title":"","type":"","bot_is":"","total_users":0,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-09-03T21:47:25.612047Z","times_seen":93643,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/a6c45a36-4aad-4b4c-8ba3-7a097094fbc3","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e591945c73bc4d8be8200a254951223c","sha1":"48783a2c07573cd3d0f385c502bacf101e830e83","sha256":"43cfc7ec520bc40db00b623e5b17cc9aed123bb1190b8ec6f05cb324dc42498c","sha512":"bcd92ae81f32fbb4a7f46feb9100ac633cfff26f1ad2dd6861c01987366f9be4072ecb0b19b5c47b9daf7527352b30b3c7b9139935c990ee54421de0aed63d13","ssdeep":"6144:QLLXU37K4Mynqg4TuxND7bLMWB32beEAK4+59vS:QvXUBnm8UkK9BS","tlshash":"27f418413f8e00b4d95b3afea1a74489f43878729fcd70c5f61c9ed5af58b61a1c6228","size":763971,"data":"","first_seen":"2026-09-02T17:05:31.09703Z","last_seen":"2026-09-02T17:44:26.47479Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"ca9907f9269d59088215ac7dde3d4bc3","sha1":"c5279417f28cb5311b9758e8718a379dcd7607f8","sha256":"18d0ea3573281ff2f3268c41b00751fa5581c7ffffc4d1595e4026cba7bddde1","sha512":"c6d968fba0ba38f1f7608a8712b8947b54fa54482fdedeafd146672fd326fd5efebd0182bd87b68b76191f3c2bbaec3b14f5c011d8bdb0e81b5844c1a8613557","ssdeep":"1536:oZDqjvqJQGF9xGzGhV+DmNkmIuyDLlVpjIxkU03jq1vM:wDMvqJQK9xGzEIDKUDLzJf321vM","tlshash":"b8e3b5c91a06d4d19e6222dec4b3f409e1248e23ceadf1a7e52ddcc1756dfa2849713b","size":150176,"data":"","first_seen":"2026-07-23T14:05:56.323298Z","last_seen":"2026-09-02T17:44:26.476435Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e1ee9f442371606d9a13b41a0dbeaff","sha1":"a05c25c8ad9127fe7d45319ce13e8b4a485d2e01","sha256":"713285cbc0cb910dfd2e7a86c604d191a27789ae50964ab1c674507ff4a20c45","sha512":"1dbac9fa1e0b338e780a3600f1a3da140a6c83a961a1d0c6c80fe3dc5a9041c346c471d264a07ccc87457cdccc2a28b768d02283512ba9cee0fc2e2b7124e42d","ssdeep":"","tlshash":"0221fedeb2826488526794d742cd8dceb8e617a919008c20452ef299225c3e8fb6ad54","size":1177,"data":"","first_seen":"2025-08-01T04:16:24.218288Z","last_seen":"2026-09-03T11:53:31.1175Z","times_seen":3425,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1e21743cd2ee2004cd56bfc5c29e3609","sha1":"bf516634ffbcfd3186b71dafc0ecdcc47894c439","sha256":"0e428980439e794b176e0ee3cd84e4878510b1d52c1efc1c00f4af9729a17029","sha512":"4264e5ce5b4f3acb24046582388132a5915398c9266c18c6349d75fb94bd74bac990dc6ebd12e1e118a3a24752a3e4badae2faabd69b9827d1f223a0750da4c2","ssdeep":"48:atoyTqSsM+c69M+c69M+c69M+c60778KK7NaaM//M+A:atlDNDNDNDl778KKw//M+A","tlshash":"25913f32165427da63ce8fd45a85751d01d2c89a383e60bdff3279eded3a683c031612","size":4506,"data":"","first_seen":"2025-08-01T04:16:24.215618Z","last_seen":"2026-09-03T11:53:31.11859Z","times_seen":3489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a97d6ef5abced657bf5d46b969b239da","sha1":"212f1fc55f39b82d41e88c7628aec3b33d263afc","sha256":"fd3d3ea23ebc1d6ff9299cbe2cc651dfcd714b9be828c8ca2a81540e2f85eaf9","sha512":"6f35480a04c1360f72ae3d1dec34f1357b49fb10a7c7e6de8124e33a87b075127206686daa9145d40be27c4dd761f078d085a1f2538567c714ede67f66122c7c","ssdeep":"192:7mmQewTVPeY8DpuTM3kpVg9LuKXgnudSWXLPKPIlH4SjmnUYsCc0V02Y2pE2XuCh:7mmQewTYY8Fb3kjgTtLPKPIJgcx0V02l","tlshash":"8732c5b06a242ad911d604e20ace4f5d74f591611179dc249b3ef28a2fec3cab7d37a1","size":11308,"data":"","first_seen":"2025-08-01T04:17:54.885074Z","last_seen":"2026-09-03T11:53:31.113782Z","times_seen":1654,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f278e1582a6b32d6a9a05328bba73b0f","sha1":"02780b645a044990e49787663d3dba06626b1e3d","sha256":"07317dc90130ec69ed8e07a8362168074f9067473354101f361449cff37110aa","sha512":"08463b63ba1654bf203117d8f0c0a2ce4b5d92914ffba7c8ac3d942ff1a812c86cc61d9e840e5f3422c2b22d1b71b1a06b9a6d40d4e4259b32fd8cd40cc8357f","ssdeep":"","tlshash":"55319948a43216904242e8f1c676abeeabe774080574446d349cbec7eff8447e521678","size":1529,"data":"","first_seen":"2025-08-01T04:16:24.221852Z","last_seen":"2026-09-03T11:53:31.107385Z","times_seen":3535,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"763a233f5ea437b6a02b61608b0f012c","sha1":"1240c4b1d8914fd04ce0f70836768205a37015a5","sha256":"6be291c8fa550034a122fa4871889e0a2ea975e673b2747bd098fc29fecc5cbe","sha512":"4d2f840cf6a29c696d75505d27ae444aee0fb0d29ac121f841a656f62b407d9d89cc6418d6e72673778fbffb14134d8df742c3811d7d17047fbf2009e54cdc23","ssdeep":"48:iX2t3RT0iLCZXEEt4k7On0KbMVU7XgPD2gxV2dgcBelfloWuqFfoWp:iM7k7O0KA+7Q2gxMdgcBeYWRAWp","tlshash":"d191fe8dc2fa07716d53b0b827cbb1283236d05b2590da463e8d43491f8976e82f5bde","size":4306,"data":"","first_seen":"2026-08-31T07:38:22.550954Z","last_seen":"2026-09-02T17:44:26.480723Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"93619a1ea75fd6e96d780b652e5e96ad","sha1":"ba176cf5556bf91be44ca8aaa8aa4c1bb7927516","sha256":"ea9eb998df518b4f18587517af8bb42258e94e4672627f62cc31328e22a2f24c","sha512":"ba423f8174386db10233933fbaa65b737f2540b2d0797ca567eff0d765cfc30f00ba487abfc53f44d98868b203b24059fad299e398d8d572b71b09502c3130af","ssdeep":"49152:m7OwPEZJsrTewW2QUSvhjG+EyY4bfO3xrQanJfCpszVtKa:o","tlshash":"13f52380bd5768a6cf4811a564b7ad0785a80d1358dcf0dff628f9c134eef9281eba1d","size":3426092,"data":"","first_seen":"2026-09-02T17:05:31.088416Z","last_seen":"2026-09-02T17:44:26.483666Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"59a13eef9e5e0ec7844e58e8b47d54a0","sha1":"0fb2b2059a878b87f8524284d448dd46a4351953","sha256":"c890c150b008d069bfddb86ee2c2e3fe979515939053b4c53fd6853b68e4fe35","sha512":"7fcdb614d30b1141e9a1e134a98e2888007f786f866c24e6383106d3e003f094e72901aa295e7d3450fccf5a249b25b436401a5b9439205da6b0eec8d72cfc80","ssdeep":"","tlshash":"33f0beaf336126ca23ae6ad20796c01d1e72e4ab3002163c575a36ca0cb6f52521b07e","size":494,"data":"","first_seen":"2025-08-01T04:17:54.874483Z","last_seen":"2026-09-03T11:53:31.106183Z","times_seen":3311,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2380d391cf784bce2f77e0e16fa2268b","sha1":"2b88cb08e3d7f56772d46fe1a10d84774e8728d5","sha256":"e65fcff70fe965f3d1878fe515a7ebcd265dfe61b15461521450c882e8d081d7","sha512":"0f3264af3a045928be20d2ee1ef3af905571d07e3fc25eaeda22199baca89b8c9bff94d90d81124ff45b16c5e40df291c2f49d9464ba901d2d961f6fd1196f1f","ssdeep":"","tlshash":"e6411b1e00aa0aa31ba3054333ce846d0956c2cedcc73534d3b27f8134c67832a93bea","size":2254,"data":"","first_seen":"2025-08-01T04:17:54.882582Z","last_seen":"2026-09-03T11:53:31.114935Z","times_seen":3355,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3433c9d3e9b7e8e5b34ed72e309db572","sha1":"d53d7df082088749c1df6b08330ee9b9e4076932","sha256":"1d96fa9904e3743570bccd5be90e83fd91975299f374093cc6f723673d582dd1","sha512":"ffd0e047331871f21738643968b7eb7fa045ee0e45346a9ea986c4b8a3e745dd310542c6b2734f6d244408bba6548ec66f5cd7662c69485b5e59e3b9432cdff2","ssdeep":"","tlshash":"06f04245bd825a24d35670ddc41f978cc53690dd91491c4cbb64ece1de94c2cdfc6534","size":585,"data":"","first_seen":"2025-08-01T04:16:24.219641Z","last_seen":"2026-09-03T11:53:31.121588Z","times_seen":3574,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/59c7fc34-f6d3-4947-8098-472e7f10f171","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4730668b05228a99662df1945eac811","sha1":"21da1a0af789cbc0ab824113410526c302000329","sha256":"32950d9dd21c29cabbb396f476b76708ca74119fc30b11a725708dcbec7e0e9e","sha512":"37ac8ac49547c4591a4adfd3ceaa86359d848365bd5499418d99832210f93f233e3a5ffcd70211b19ac28494a3c7e0052b4973c793bfca7aee6cf5f464d3a27e","ssdeep":"49152:B7OwPEZJsrTewW2QUSvhjG+EyY4bfO3xrQanJfCpszVt0r:S","tlshash":"1bf523c0bd97a8a6cf4811a560b7ad0684990d1358dcf0dff628f9c134eef9681dba1d","size":3428484,"data":"","first_seen":"2026-09-02T17:05:31.0752Z","last_seen":"2026-09-02T17:44:26.496153Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/jquery.min.js","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"90660c8b8e24d13932b4d1f79cbb2451","sha1":"9fd570a328662fc5648c4c4433ac6b52bd72c3dd","sha256":"212d0e0b838138d6911931ac47fe366f52e9e6686f72e044904d84eb69fe23ce","sha512":"5451dc8fc8013f77536127fef16501d7434307322a5b37742069ef52ce41363042084cbf450dc1f28927793eee6fee4bc8da43558a23264655e2842c09bdf1b5","ssdeep":"1536:/XjhjfKMB/ZqxiE4RyzgFTMd8vkkIuyDHVHjQXkU0XDsRJ0:/jh+oWiwzAQdayDHVDjXoRJ0","tlshash":"0fe3c7ca1906d4d65e6521dec4b3f809e0648e63ceadf057e62ddcc1752efa2849323b","size":155134,"data":"","first_seen":"2026-07-23T14:05:56.310836Z","last_seen":"2026-09-02T17:44:26.462635Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Telegram:map[actor:server1.conn0.watcher17.process7//obj23 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[kind:Object ownProperties:map[description:map[configurable:true enumerable:true value:Bad Request: chat not found writable:true] error_code:map[configurable:true enumerable:true value:400 writable:true] ok:map[configurable:true enumerable:true value:false writable:true]] ownPropertiesLength:3] sealed:false type:object]","filename":"https://cashscat.cc/","line_number":111,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"cashcat.cc/_next/static/media/001535c430eccedb-s.p.woff2","fqdn":"cashcat.cc","domain":"cashcat.cc","tld":"cc"},"ip":{"addr":"216.150.1.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.895Z","timestamp":1788371007895,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cashcat.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 26 Jul 2026 08:00:49 GMT","end":"Sat, 24 Oct 2026 08:00:48 GMT"},"fingerprint":{"sha1":"2C:EE:50:0A:9C:3B:5A:C8:43:E4:3F:1C:05:F0:39:F5:7F:F6:D7:96","sha256":"3B:CA:23:DE:5B:AA:63:D6:6A:F5:24:07:C3:79:EF:A7:70:AB:2F:91:5E:08:5B:FD:12:82:F2:EC:7A:74:A6:98"}}},"request":{"raw":"GET /_next/static/media/001535c430eccedb-s.p.woff2 HTTP/1.1\r\nHost: cashcat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cashscat.cc/\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 32203\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"not-found.txt\"\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\netag: \"9d1ead73e678fa2f51a70a933b0bf017\"\r\nlast-modified: Wed, 02 Sep 2026 08:46:44 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/not-found.txt\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::ncjjc-1788371007954-7f2c4a8041b2\r\ncontent-length: 9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9,"size_decoded":581,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"9d1ead73e678fa2f51a70a933b0bf017","sha1":"d205cbd6783332a212c5ae92d73c77178c2d2f28","sha256":"0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5","sha512":"935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34","ssdeep":"","tlshash":"a250000c0003c3cc0000003030c0000000000300300000300000c000000000000c000c","first_seen":"2023-03-08T03:03:03Z","last_seen":"2026-09-03T21:27:13.092849Z","times_seen":90450,"resource_available":true,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":21,"connect":8,"send":0,"wait":21,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/webpack-9803866aad8f22df.js.download","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.900Z","timestamp":1788371007900,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/webpack-9803866aad8f22df.js.download HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:58 GMT\r\netag: \"6a5feeae-ec4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2391\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w87ZbHLG1a5W8pCc208l7oZBupfQMKMrz9uJZoUUspgLHV7R%2FoA3uzsyOKtBj4SYujtldr2A%2F3RoCLhpLZ%2BTbUcld6Pxw7Zfr%2FBOGY%2BStHr%2Fz%2FkzvgZsYwP3HhJQMg%3D%3D\"}]}\r\ncf-ray: a34e512f6bd90731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3780\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-03T21:47:53.954795Z","times_seen":18262872,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/338e6e2c2be0cca6-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.167Z","timestamp":1788371008167,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/338e6e2c2be0cca6-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nYB1zZQ2um2H6AUfz4NzsjE%2Bktgs2YIczRZ06hf1bFs7%2Bmh9RAUX98JzOqCWxRIk0JDX6GMx7AVvP9UiSDocdAZuh8cYO1e3ujbKaF%2Fw9RjinuLBlndzWCSGX9tn2Q%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51310c220731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25613,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/338e6e2c2be0cca6-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/e9f67b0a1bfb7388-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.173Z","timestamp":1788371008173,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/e9f67b0a1bfb7388-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X6ddeuLbK9M16dfY8XQPh2QT%2Blh5kDlt1T1BdUGQcCqgmliJeMAD3pvWYwZC0jU5lSGpyvazCztEFzjzezLszszvFBivs8hI5Hdp5ssM5n%2FgOjlVA4HPUgc1KlzFsQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51312c270731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/e9f67b0a1bfb7388-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/1e6f4a4be8352cbc-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.276Z","timestamp":1788371008276,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/1e6f4a4be8352cbc-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TLxLv0Z1M1JzodvePTEfvcV7h6jsEjjdkOkBh2iCZVt5FEEMY0yEqejjV8hC%2FON2NXAbb7NJKy6KyP%2FSieu85q8ezmfhWTAMETjG7KMa7hqr1ICrgYsd0JCdlBGTzw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc680731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/1e6f4a4be8352cbc-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/secureproxy?e=jscdn/getFile","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.379Z","timestamp":1788371008379,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cashscat.cc/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"i654mfhc04mrhtzahifc\"}"}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rv8fhO1bWBZnI8gpoQyj0TfwTl0Y6kAx7jBByhxPPLyJhi8xu3mvNXpPn%2F%2FhuHfbCBas9XTKUyiD2qTpDUJ5vdaI8Nzcqy%2BQZjIIpHdXgleEWIciJWC8X1ryoa4LZ6JSnfEYxJU%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: a34e51326c860731-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3428484,"size_decoded":2636497,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"cb6bb2c78cdf8c0d9892bf9527a51067","sha1":"0282fec63eeabe9db332e490ccf0900b982977e4","sha256":"23e662c6e27ab20faabfaf907ed51c28091473448306e1a7d8138c04b9762624","sha512":"c3a4ce07ff773001121a634fa64857e307271692e5e5ff0d830fc166eba7f7d423534d2e63ddc702ca9e04563857276dcd07e6c9f4e1a047a955969014b94517","ssdeep":"24576:BV8/8Yae0PgGswPpBroS7InwbjtsJshJuEbd/BBL:B7OwPEZJsrp","tlshash":"5f252340ad67fd9a4f4ca9b570b76d0769404f4288cc64cfa97aeec021ec77241d9a2e","first_seen":"2026-09-02T17:05:31.062592Z","last_seen":"2026-09-02T17:44:26.453336Z","times_seen":2,"resource_available":false,"data":null}},"time_used":572,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":377,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.897Z","timestamp":1788371007897,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:56 GMT\r\netag: W/\"6a5feeac-73d80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2391\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dZFpN2OS8L7zLuHN1qe9yiqeM7eH26C0tmHwCmvhPSplAABrp0Lj4nyBeziLoMRK3kZzdXtZXmXyX5c%2FWoik5Yykcitbadg2MC7URpCyb3WHR62RQF98PlhPWNe7iw%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a34e512f5bd70731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":474496,"size_decoded":171362,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"7a4911dfc834d2c6882fe56f420988f3","sha1":"e52a7f4c11fe2b50080cbd800c09c790515f47d9","sha256":"f598a6900bd28dafcd2a582feca96530851c6ca2c37b7ebcd241e584d8124ede","sha512":"7c3f56eb44304e1468281e802669391af8b29b3523697e53e06c32ccd3ab16112b5b28f4f6661645b6c9196d754e95cc816b3bcb848867739c6304711c9c0c27","ssdeep":"6144:H0d2PqeMeuYwO0fxMMoxJUteY0qQlxEvhoAsn0DAT50KUsjOl0uUiJxr09jtq:CeMfoxFEvK0KQxrz","tlshash":"01a44370850b100ff073bb517bdbb2361e79281462840d138eb99d6719afcd5baa2b5f","first_seen":"2026-09-02T17:05:31.064499Z","last_seen":"2026-09-02T17:44:26.455228Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/6f2049edee8beeb2-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.149Z","timestamp":1788371008149,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/6f2049edee8beeb2-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BtHyOVneqeyO%2B6LUP6%2FDPUtUKZVqkUo7IjHqMu%2BsQaByxQMrmyPXmBU%2BUiOuMUxR7pJNx6jTnRH9NRN31ZkMjaIy1E3P8MgmSqsflsKZxSXIdtjK2p5bD8ag%2Fx8k%2BA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130fc130731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25619,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6f2049edee8beeb2-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/27145be036dbd745-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.271Z","timestamp":1788371008271,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/27145be036dbd745-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z%2FKd1RMdw965P0PVdTaGtEn5%2FUZJRUdMQYaw4ZqKP08o2RldkHMcNDXQYkBRZsnenXpSqurrxdcn9Mw%2BZxPwgNEoZnCB046jy3v%2Fp9SHxMcRcEtDTQlRfbECGPIMJg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc630731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25615,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/27145be036dbd745-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashcat.cc/icon.png?1be9e27a6e86b7c4","fqdn":"cashcat.cc","domain":"cashcat.cc","tld":"cc"},"ip":{"addr":"216.150.1.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.101Z","timestamp":1788371008101,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cashcat.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 26 Jul 2026 08:00:49 GMT","end":"Sat, 24 Oct 2026 08:00:48 GMT"},"fingerprint":{"sha1":"2C:EE:50:0A:9C:3B:5A:C8:43:E4:3F:1C:05:F0:39:F5:7F:F6:D7:96","sha256":"3B:CA:23:DE:5B:AA:63:D6:6A:F5:24:07:C3:79:EF:A7:70:AB:2F:91:5E:08:5B:FD:12:82:F2:EC:7A:74:A6:98"}}},"request":{"raw":"GET /icon.png?1be9e27a6e86b7c4 HTTP/1.1\r\nHost: cashcat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 44076\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"icon.png\"\r\ncontent-type: image/png\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\netag: \"bc446cbc08b9a33d8013bcf73dd98df4\"\r\nlast-modified: Wed, 02 Sep 2026 05:28:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /icon.png\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::j9znr-1788371008186-73474bd50aa2\r\ncontent-length: 69395\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69395,"size_decoded":69932,"mime_type":"image/png","magic":"PNG image data, 343 x 343, 8-bit/color RGBA, non-interlaced","md5":"bc446cbc08b9a33d8013bcf73dd98df4","sha1":"118fc9725b0ee639a813591e5c42874907f26425","sha256":"44310528460f2807f4a0b668639c91688546bd17830852d45d4013529f1f6210","sha512":"af4b4bcfb7fd1a5ad18ddcc41d9c9293b1bf66eada9172016e1f289bf551ae9488682a1b85e232f2be34b170733cd963900ff125bb4ca0987fbf1f69ad525330","ssdeep":"1536:WhZK7XH8REcaYpP7L7b6L1S5EAGYWuBruN9x3B3BJ8qV:WzK7XH81a0jL7b6BS5OPuBruHx3B3r1","tlshash":"e36302ce4e37d62a45bf66498ac502b80aeee8242eac1637c67483f03154c5953ff91d","first_seen":"2026-07-08T18:34:01.787846Z","last_seen":"2026-09-02T17:44:26.457101Z","times_seen":15,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":30,"receive":8,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashcat.cc/icon.png?1be9e27a6e86b7c4","fqdn":"cashcat.cc","domain":"cashcat.cc","tld":"cc"},"ip":{"addr":"216.150.1.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.102Z","timestamp":1788371008102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cashcat.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 26 Jul 2026 08:00:49 GMT","end":"Sat, 24 Oct 2026 08:00:48 GMT"},"fingerprint":{"sha1":"2C:EE:50:0A:9C:3B:5A:C8:43:E4:3F:1C:05:F0:39:F5:7F:F6:D7:96","sha256":"3B:CA:23:DE:5B:AA:63:D6:6A:F5:24:07:C3:79:EF:A7:70:AB:2F:91:5E:08:5B:FD:12:82:F2:EC:7A:74:A6:98"}}},"request":{"raw":"GET /icon.png?1be9e27a6e86b7c4 HTTP/1.1\r\nHost: cashcat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 44076\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"icon.png\"\r\ncontent-type: image/png\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\netag: \"bc446cbc08b9a33d8013bcf73dd98df4\"\r\nlast-modified: Wed, 02 Sep 2026 05:28:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /icon.png\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::sdpj5-1788371008186-160c336db74d\r\ncontent-length: 69395\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":69395,"size_decoded":69932,"mime_type":"image/png","magic":"PNG image data, 343 x 343, 8-bit/color RGBA, non-interlaced","md5":"bc446cbc08b9a33d8013bcf73dd98df4","sha1":"118fc9725b0ee639a813591e5c42874907f26425","sha256":"44310528460f2807f4a0b668639c91688546bd17830852d45d4013529f1f6210","sha512":"af4b4bcfb7fd1a5ad18ddcc41d9c9293b1bf66eada9172016e1f289bf551ae9488682a1b85e232f2be34b170733cd963900ff125bb4ca0987fbf1f69ad525330","ssdeep":"1536:WhZK7XH8REcaYpP7L7b6L1S5EAGYWuBruN9x3B3BJ8qV:WzK7XH81a0jL7b6BS5OPuBruHx3B3r1","tlshash":"e36302ce4e37d62a45bf66498ac502b80aeee8242eac1637c67483f03154c5953ff91d","first_seen":"2026-07-08T18:34:01.787846Z","last_seen":"2026-09-02T17:44:26.457101Z","times_seen":15,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":19,"receive":10,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/d3ebbfd689654d3a-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.151Z","timestamp":1788371008151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/d3ebbfd689654d3a-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/c0913d7291a5120f.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mlz5SsczPQII5lS7fXziO%2BHk80CnZiOCeJ9AXgpqyD3KfCLsraGN4oz3auDtBjKSsvVH8OIQv8Dazi6xlqnPfwQUT7ZHaB87haJy3Qq4N2Dtej2TSDZi%2BUNCnxXIPQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130fc140731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/d3ebbfd689654d3a-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/2caafad0d9e33075-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.152Z","timestamp":1788371008152,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/2caafad0d9e33075-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gHDJwGmg3mLi9yAVVi%2BdoS%2BoU3Br8%2Fi%2FtM3Wu6QsdRHnbyHDzBoDCdphUli08rAyXCuYoZEtqcIjlPTuFxZI%2B1s4ZIbEd56k2ADgjLNA6pNL4p%2FD%2FDLn1iZXbLNGsw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130fc150731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25621,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/2caafad0d9e33075-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/d1f93f19f5eb03d0-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.162Z","timestamp":1788371008162,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/d1f93f19f5eb03d0-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7lku5CPmLT8YQi9G1%2FEfel2pgb9DwY2KL%2Fn4D%2FxgYqvxorHbO8CXa6g6a5lgJmK%2FRckwVUGrpDBrEsZUkUu4q8FF%2F3EiqXsBuwwkYeiA7BmBVMWUuoEm6ydHbFQvGQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51310c1f0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25617,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/d1f93f19f5eb03d0-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.200Z","timestamp":1788371008200,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://cashscat.cc/\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-03T21:47:53.954795Z","times_seen":18262872,"resource_available":true,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":22,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/47edecb87d4c975b-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.269Z","timestamp":1788371008269,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/47edecb87d4c975b-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g5jLM%2FXWC%2BmqtOfYM04RNGtSl1f6QFpcd2dy6YK4aQweiTKScaYUHSxu91LR94Kp0ur89t67XHy3J9GiOK1qCAj5wxOWUTaH5MeVNOmebLyhwVQRcHUW%2BFFbxSPNsw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc620731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25613,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/47edecb87d4c975b-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/a51329d32af18bb8-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.275Z","timestamp":1788371008275,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/a51329d32af18bb8-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HoCCR9VOn9A3ITd28LkAf098QQrmUTPxuh%2FUWY0M6EMBS9gkf1xdXe8SBfuV%2Be6bA9YcmRXpYiu6WpYGcKKye76sUKGqq28oZYqOdPbR%2FZkkGeW%2FO0tA0BGZJTMJxQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc670731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25615,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/a51329d32af18bb8-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/vlad-tweet.jpg","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.907Z","timestamp":1788371007907,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/vlad-tweet.jpg HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:58 GMT\r\netag: \"6a5feeae-9969\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2391\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wVE2g7%2B4yGHKF2%2FM6Za0JqxhUtqoI3dgw4lsDapSd8M66rnQt1w9AKPZq2DWDbhJFxNg6Xag1iqQW7YKUuqg5sLPn%2FevDIrNsrRlY3coXfgYRGkt0XnhuC9IN0NtPg%3D%3D\"}]}\r\ncf-ray: a34e512f6be40731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 39273\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39273,"size_decoded":40207,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1024x512, components 3","md5":"a78303b6a1d56964c26ddf22e4d0f184","sha1":"1cf1133b8fbb937dffb22f57a6ca800cf115292c","sha256":"caa792f4c68cd2e57828a6c7f46570b59250a316e09c9bca768acf574bb130cc","sha512":"2482b12bb5bc56ce1e95061adfeaf1e3dbbf07343d1cc71de8bed2989bd3662039606fc3578baff42bdfc8fe165dc7b438c3d700ea8021083eff1073f9dfe883","ssdeep":"768:JwXfJSXtS/wtWqxZc5+/0cnE28lgeVfvc48yPxr7SBX9I9HOyYwkcPY4qg7p:WX8Xt7Xc08cnElgp482s9iTkcPZBp","tlshash":"ff03f19ba67bba6ce07e27b10c4e12395675dc3a52b74b43d10b17842b6f5320e0adc3","first_seen":"2026-08-23T18:09:50.465939Z","last_seen":"2026-09-02T17:44:26.458511Z","times_seen":3,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/3637a1b0f55928bf-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.100Z","timestamp":1788371008100,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/3637a1b0f55928bf-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LAfd6QnsQNd4tdt59h3Ih%2FGnMRwVKWLAdgpjgveyI3ZZvNiVBY0PyX9yURxNNOfqTwswhNx85P8nuOloam7kgWWb%2FOe7ppCEvQp9G%2Fk7QhvQFDjtqeoKl3v2bHTVew%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130ac0f0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25613,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/3637a1b0f55928bf-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/4c48dfb25870a9fb-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.161Z","timestamp":1788371008161,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/4c48dfb25870a9fb-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W08CyftBfQB6fCRQUciw68rYJH6zf195lWlL3dlf%2FMy2xlJ%2BM1CXAOqToTVo5MdaseRt2tbjKtEefTeog1H2SCZxbe0ND%2BftWDGHcaz6p2aXRcYG0%2BgFhUTb4Yh3UA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51310c1e0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25615,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/4c48dfb25870a9fb-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/daa198f43674753e-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.266Z","timestamp":1788371008266,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/daa198f43674753e-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8ADGH1Dv1XK%2BSW%2F%2BJkxuN%2Fx005wXzWbDnPD7xzu8qawFqojYdag2US%2B38LwXrk4E2poIAK3enFmYF3x2bKlGPfTek7zQn657JWgFcc8ylCHy8Idx2Hn0fgCUiKVPyA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131ac5b0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25617,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/daa198f43674753e-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/8c14efce11d511c4-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.273Z","timestamp":1788371008273,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/8c14efce11d511c4-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RPtMiEs7j2xNY4o5IOT1c94UWc7bQsxaqPJI9hHinp%2BQsuyM%2FPhyL6dAGv%2Fg0RKtpkDZxNz2lOB81w%2FRR5UzVZOkX6WPPXLTzUh%2BK%2FCugqqPcwktsDAP1Vwqnsig3Q%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc650731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25619,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/8c14efce11d511c4-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-02T17:43:27.472Z","timestamp":1788371007472,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XaAapr3UfDl%2BvvMpYqOow2iXyUFu77RVPvxASdfNSEcHoTjIwxJuVsAOlbnIOo1xQXoNOJRSgLwBNLYhLviizdP89iVVsgZ9K5V8K1lxEQ%2Bc3tOWflOtuoDCM1tqUg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 2392\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: zstd\r\ncf-ray: a34e512ceb38b505-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24722,"size_decoded":8034,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":40,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/cashcat.png","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.904Z","timestamp":1788371007904,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/cashcat.png HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:58 GMT\r\netag: \"6a5feeae-10f13\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2391\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ka8KLyE%2BDgQdbwYJ7kjtMqa8iJ7zVDe5x9%2FUzvr2J69SsqAgy9aYfsai55Q9YzuG0GhUjIScQjk3tM%2FA3Qxntp4kY5mmbXfDEdJ15Flg0N1beiZzaZa52CFhbF%2FDaw%3D%3D\"}]}\r\ncf-ray: a34e512f6bde0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 69395\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69395,"size_decoded":70331,"mime_type":"image/png","magic":"PNG image data, 343 x 343, 8-bit/color RGBA, non-interlaced","md5":"bc446cbc08b9a33d8013bcf73dd98df4","sha1":"118fc9725b0ee639a813591e5c42874907f26425","sha256":"44310528460f2807f4a0b668639c91688546bd17830852d45d4013529f1f6210","sha512":"af4b4bcfb7fd1a5ad18ddcc41d9c9293b1bf66eada9172016e1f289bf551ae9488682a1b85e232f2be34b170733cd963900ff125bb4ca0987fbf1f69ad525330","ssdeep":"1536:WhZK7XH8REcaYpP7L7b6L1S5EAGYWuBruN9x3B3BJ8qV:WzK7XH81a0jL7b6BS5OPuBruHx3B3r1","tlshash":"e36302ce4e37d62a45bf66498ac502b80aeee8242eac1637c67483f03154c5953ff91d","first_seen":"2026-07-08T18:34:01.787846Z","last_seen":"2026-09-02T17:44:26.457101Z","times_seen":15,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/vlad-avatar.jpg","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.906Z","timestamp":1788371007906,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/vlad-avatar.jpg HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:58 GMT\r\netag: \"6a5feeae-423d\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2391\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RKCw1%2B4yJqzBxmo8eLrK3zzW8BmIXAHASeA1amZ95Qccf02Sk5eMUT%2Bdwxo8RMNQkelNFqjcODOUlTP6WD0e47SprwAXfInFzHnV%2FpHCXjA%2BZ5%2BaszOLeXsib6CKGg%3D%3D\"}]}\r\ncf-ray: a34e512f6be20731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16957\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16957,"size_decoded":17895,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"0b338d4145cc7f95dbbc41024a9ecfae","sha1":"adef3c9b8490b65da99aff316dc9cf9cb4f0f95c","sha256":"56bf60c469cf81743e88eec2a89a0200d0893c0cd169f8e9258f3fb57042af23","sha512":"9bc43c88b32a1e92937c5eda85d1776c12a6538a641b1b2ebda613857852469d67240bf8d4ce95be9e5752a4ebae405a1cd1f7f43ae08fee2eec9b3f0f47eab9","ssdeep":"384:sHv/SxYmTfY+vOW8DTVK2YJ7J8s416D3NX:i6mm7jvQDTVKl78x16hX","tlshash":"5e72cfa363960ae5f02f0232517e8942b73dbc656389c777120691487ffe098d7b9355","first_seen":"2026-08-23T18:09:50.454996Z","last_seen":"2026-09-02T17:44:26.46023Z","times_seen":3,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/7f612c65de6e1300-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.148Z","timestamp":1788371008148,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/7f612c65de6e1300-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3Q5J%2BCVPl9utLNtcRaKxW9kuL15CCOda10JFa2hZHpBzW4IFqWNlVf3VtjdeotnjJv5jObaAlI2JE5qZDK09vfV0E4lPVfRfQj1g7ZAUzuhut5DSKRwrt5cwI8GSDg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130ec120731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24722,"size_decoded":25609,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/7f612c65de6e1300-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/98e207f02528a563-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.153Z","timestamp":1788371008153,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/98e207f02528a563-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/c0913d7291a5120f.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H4BOWjqPFBJuCgi2S%2BmGqjPvB8zQWVHNc7lFV3uIwdNU%2F0PLpLx6%2F8H%2F%2B5jIp%2BsbG3grrB5cVQ3ZKije31h5AR%2B8jKOjwdlHUFSYOdWjdOGUmmi9%2FUfUf63itED0eA%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130fc160731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25623,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/98e207f02528a563-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/8fbf8aae21cd9b52-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.159Z","timestamp":1788371008159,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/8fbf8aae21cd9b52-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vIwxiJMMDyEzESbnrSRIfIeOMtnjAlUCHL9Qzdla9ih2kEqTlFIhCXw2GvL%2ByWoN%2BYvJdRdXoMsUSv%2BErBtQujiyUmPA3HkunDtd7Ab21wDylLdcYnxMNTNjy%2BlThw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51310c1b0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24722,"size_decoded":25615,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/8fbf8aae21cd9b52-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/null?e=jscdn/getFile","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.163Z","timestamp":1788371008163,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"POST /null?e=jscdn/getFile HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cashscat.cc/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"i654mfhc04mrhtzahifc\"}"}},"response":{"raw":"HTTP/3 405 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y7AqBmotc%2FgEkCmb01Lcm7QxQIuUbDKCcK2RmApYkZ0E6I%2FjJw6Eblq0KDwPJhGDSbqprGt%2FKvLto%2FREqrC1tHfjaewdbBcQnUUUB%2F95N8s4oN%2FRP6E%2FBtRptVAmYQ%3D%3D\"}]}\r\ncast-mode: default\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: a34e51310c200731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":166,"size_decoded":937,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"cc1936e6c20f6a866226130b869d9953","sha1":"65d15aaa085d0c6292e27fecd97ce7c90deb4ee6","sha256":"11f4864b57acc22316998d012efc32274ea8c3f3230acab7bc8ee576c594b203","sha512":"29d5ff85814c6470cd6665b01d1f2b4b9f2303605c922f6f685375875ad1aeb23d80d386497164fc8cdc713968557cbe55b55b8c571ae27dff53c55790f382d6","ssdeep":"","tlshash":"7dc08c6e271b3c48c6a321751ac3f4b0c29da2a284f847006844005331c32169acbb51","first_seen":"2023-04-11T14:00:01Z","last_seen":"2026-09-03T11:52:47.71771Z","times_seen":945,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/3195ddcb8417d111-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.168Z","timestamp":1788371008168,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/3195ddcb8417d111-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pzKN95yCn5cdVMspJFphNc2xcmgxQI5ivAV42utrLbP0tcVw%2FAlHZwUk9HC9%2Fdw7qBiAOgUI4v0VO8xbtJFxynfVvSxggic2y0gVI0lWP2yR599QSchnrNBD%2FazsVg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51311c230731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25613,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/3195ddcb8417d111-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/jquery.min.js","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.893Z","timestamp":1788371007893,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /jquery.min.js HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 17:42:28 GMT\r\netag: W/\"6a5faf84-25dfe\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2391\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=im3RpK97BssmobKbg7cFZ8WJiMOsVjtexEiWfqZkW6UVCyFZbj%2F3M7HA54W8CG8qbS%2FcEc%2Fvmmqz2PD1EiuWSMSdZPBZdGlBWInqspve81btyBLSB7ngKWkrN6POAw%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a34e512f5bd50731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155134,"size_decoded":44380,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"90660c8b8e24d13932b4d1f79cbb2451","sha1":"9fd570a328662fc5648c4c4433ac6b52bd72c3dd","sha256":"212d0e0b838138d6911931ac47fe366f52e9e6686f72e044904d84eb69fe23ce","sha512":"5451dc8fc8013f77536127fef16501d7434307322a5b37742069ef52ce41363042084cbf450dc1f28927793eee6fee4bc8da43558a23264655e2842c09bdf1b5","ssdeep":"1536:/XjhjfKMB/ZqxiE4RyzgFTMd8vkkIuyDHVHjQXkU0XDsRJ0:/jh+oWiwzAQdayDHVDjXoRJ0","tlshash":"0fe3c7ca1906d4d65e6521dec4b3f809e0648e63ceadf057e62ddcc1752efa2849323b","first_seen":"2026-07-23T14:05:56.310836Z","last_seen":"2026-09-02T17:44:26.462635Z","times_seen":29,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/75d0d809d177ae2f-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.154Z","timestamp":1788371008154,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/75d0d809d177ae2f-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r70MM0kEmr1GggXYpbPX7d3qLGU%2FfcEIniwblOWsFW0tdyjkiQBW69262wHlGqRIZIPME53zy4zRQogSGB%2BqC6VKJdb%2FgVP5KitSVG3wey0ryMrmKeJmCoKaAAJfEg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5130fc180731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25613,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/75d0d809d177ae2f-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/2a3b9c9294c3c3e8-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.160Z","timestamp":1788371008160,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/2a3b9c9294c3c3e8-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OZiLjx5RI%2F3DYv6I8LuQu4yGR7Pgkefks0JtNIlHW3pxeF7sFMdksd4KMO4NL2uZy5O5xtZ7Yx6wYSRdaU645URh1KzQZScLQvFqj6FMuRFruFPAS6g%2FOtvFsCQ6Cw%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51310c1c0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/2a3b9c9294c3c3e8-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/35731b92a9f1ef9d-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.274Z","timestamp":1788371008274,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/35731b92a9f1ef9d-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FmKGF53Mgm6LfW2ZdcOk%2BAYRXL82paUJA0YO1dMcqfzrgIzFzo4OJCKC6NYYzN5twHT6jRv12mWIC4tQY3C7XSPrIvofURBiUUKx4iS%2BfEgzSydo8zgmY3mqxOeiIg%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc660731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/35731b92a9f1ef9d-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/6d7cc3a563fdbe78-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.279Z","timestamp":1788371008279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/6d7cc3a563fdbe78-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LZadiNv3ndUEqZRdLomMeaGyqU4FLTA0t07L5CqRgQRkg%2BdUHmXdcUMEm2WMilMintW4G9As7qdAdL3n8X42wCFv9OmgWRGDWuqSLkVitAywQpa0ZEahL%2FLdBOR63g%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131cc6b0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6d7cc3a563fdbe78-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/c0913d7291a5120f.css","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.898Z","timestamp":1788371007898,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/c0913d7291a5120f.css HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:56 GMT\r\netag: W/\"6a5feeac-3c51\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 2391\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q0yYNAz8giG0OHm3ekvv9ha%2FocAOubq%2F%2BHuKrmlNumJmqfl%2B3Hj4roNime1YfTqI4pP8LhxJdaut754pFlH0Q88lyh8ukbqFE7bUGRl3MJJY6hrVBJ6RAaI5HkrKcw%3D%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a34e512f5bd80731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15441,"size_decoded":5330,"mime_type":"text/css","magic":"ASCII text, with very long lines (15441), with no line terminators","md5":"e3142cac1e9361ecbb8fb662daba695e","sha1":"dde2bd0e6d6341a19e90144ac1cb2e72e6977b8a","sha256":"a09c0443762165993337cf2062723a3d5d2402370fd79a66c92229b1d2b05f69","sha512":"dd223651995f72ce74df4294f9b878cfa8889dadaeaeeef3e4f3772d2a77e08356b6d5d25cfbfaf89c6d249d459d5c6ac402dbd9188d474a0505339a285fb892","ssdeep":"384:ozBwa6IMGTPmMoiSiMGCH1MmdzUCEh+jH/QGMb6oYPzezz:ozBwKNuhiSiEH1DzUVmQGm6JPzev","tlshash":"ae6282659164912cf827fc9537c96b5f3014a807d8638be9eda19629cccbaf32371b48","first_seen":"2026-09-02T17:05:31.067807Z","last_seen":"2026-09-02T17:44:26.463433Z","times_seen":2,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/hibt-avatar.jpg","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:27.908Z","timestamp":1788371007908,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/hibt-avatar.jpg HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:27 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\ncast-mode: default\r\nlast-modified: Tue, 21 Jul 2026 22:11:58 GMT\r\netag: \"6a5feeae-4f28\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 2391\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Wo3ECU%2Bxd94zh5reCYuGcJ0v0%2FYGSnydIiTzO%2FKpi5s1%2FuH8VGYuWEsFe16Iw87X1TFaTSgdZytMLSfj00mB84WIqDd2FLGdVk6Takk%2BRtfFnTEeuRzn9uXPwffiw%3D%3D\"}]}\r\ncf-ray: a34e512f6be50731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20264\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20264,"size_decoded":21202,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 359x359, components 3","md5":"20d56ce20abe4709180fa4064edb7fb3","sha1":"fe538a3a010399c7d65862e7584c7022c5627bc1","sha256":"e68da88bb970fb53c4480a6ec5692cd7d20428ebe9b2fc4ae240dbd82acafd4c","sha512":"06a3c402622655c2460bf9ae967a7784d2068d30dc81026f0cd594279435f5b8463d3f6eabfd99dbe244373517fe17bafda8e8d0af99c94be8db43452430bbf4","ssdeep":"384:sWeiF7ZwB/6B74yMJTUGPDvaCQqI6wKPY6uTuFGjDxFJksJ4:3eiE56B74yMJG5ZKY6uaFGpAU4","tlshash":"5192c04ec3200f44f97f83b2ce596783a2199d516410eaf7d465c718bbae0f6484bade","first_seen":"2026-08-23T18:09:50.477268Z","last_seen":"2026-09-02T17:44:26.470632Z","times_seen":3,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipwho.is/","fqdn":"ipwho.is","domain":"ipwho.is","tld":"is"},"ip":{"addr":"172.66.175.107","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.045Z","timestamp":1788371008045,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipwho.is","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 17:11:12 GMT","end":"Mon, 02 Nov 2026 18:11:07 GMT"},"fingerprint":{"sha1":"5E:E2:C3:89:78:64:9F:D1:72:38:82:CE:9A:64:52:5E:6F:BC:2E:8D","sha256":"84:35:87:FA:FA:70:1B:FD:E9:C4:CE:E2:2B:E4:BB:4E:2A:1E:20:D4:9B:99:4B:F6:FC:3E:CE:8B:56:FD:9F:30"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipwho.is\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cashscat.cc/\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: application/json; charset=utf-8\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a34e51306b021a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":641,"size_decoded":719,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"17a54f0409296773c66bb591bfc606cd","sha1":"ebd624c5b8b41387fbac1fcf07d73c8a0cafb75c","sha256":"8fdc21f3a6a58a984593a1aa084ebcc60283b4b23c17a4ffb19c030c48d4b7df","sha512":"94f0d44154fea968c515cd70603367a5377565147b2eb3aeeeab9bc84c5ebb48f652284fd1a7c762b694198886afcb34d8627285ce7481bb8961898b585af61c","ssdeep":"","tlshash":"39f0682101dc7d0e81af438910cffd09257d6017d2c2518accfc5994c1c42ee704055f","first_seen":"2026-07-17T15:53:12.211861Z","last_seen":"2026-09-03T10:48:05.711732Z","times_seen":270,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":0,"dns":3,"connect":10,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.190Z","timestamp":1788371008190,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"POST /bot8654402884:AAE2YPHRSuv8qodkX3VDC9i1xiH1AVSIHys/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cashscat.cc/\r\nContent-Type: application/json\r\nContent-Length: 182\r\nOrigin: https://cashscat.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":182,"data":"{\"chat_id\":\"-1003706392935\",\"text\":\"🔔 New Website Visitor\\n\\n🔗 Full URL: https://cashscat.cc/\\n🌍 Country: Norway\\n🌐 IP: 195.64.118.152\\n📱 Device: Windows PC, Firefox\"}"}},"response":{"raw":"HTTP/2 400 \r\nserver: nginx/1.30.1\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: application/json\r\ncontent-length: 73\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73,"size_decoded":407,"mime_type":"application/json","magic":"JSON text data","md5":"5c6ec831d4ad9c0fc6ad80da351e2395","sha1":"5f427b1f2f42d384c52e9f334217822f04e80d61","sha256":"83e2e55393198eac2b970f2527ae85ffc856b9708a379fa84877261f0f36d3be","sha512":"8d5d71ea589f7241dbffba9410c83d0a239f4b6c7398b44da4f5bbefffd8395fd2b104630672896dc68ed1d8a68170c04b70d2aacece46cfba79c19a49f563a5","ssdeep":"","tlshash":"9ca0222e0accb28e80ca00308e38e83c00bb03e03c0ca0320c80e0ea00000eb2c30c8e","first_seen":"2023-04-10T21:00:51Z","last_seen":"2026-09-02T17:44:26.472736Z","times_seen":43,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/7e3c9184189bbc0c-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.278Z","timestamp":1788371008278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/7e3c9184189bbc0c-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n4DQIvKUEiP6NQmNsRQr3zhKTGnUDlNnTrLvjYxdv7ghh85lGvJQ0caT0pplLKaOygqsVEu%2F3ZgcduJBbs0iMZfdUqTOrORZjYphm8UdhTHWfXbtHX5jBSqEey2A5A%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131bc690731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25609,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/7e3c9184189bbc0c-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/4b7a4c192ae21457-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.099Z","timestamp":1788371008099,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/4b7a4c192ae21457-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o8ai9GWGJAkdCO6R%2BsRIcn8puk%2BQvYZVpdBmTbC2qajgYpGbYsMX5jgMYQaf3Y8cHG7k7w9lxqZNPJR46QecjvresxL0MyMOo8pL17EWpKQTvIkmtorBpOuXl2zRfQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51309c0d0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":24722,"size_decoded":25611,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/4b7a4c192ae21457-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/6a2969fdad2f04be-s.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.171Z","timestamp":1788371008171,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/6a2969fdad2f04be-s.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=drHp8EhQ8L5jEo%2BrsERhp6UV0uajsKE19wCW7Rz4%2FI6qfJw50EYla%2FGfp%2FArB%2FMWfwAKi4lJwkhf4iJYZk8KfD32OrweWV0EwynJNrUSO1kfQnndyde1TGxbJYgTOQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e51312c260731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25617,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/6a2969fdad2f04be-s.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashscat.cc/_next/static/media/24f6455c18489ce9-s.p.woff2","fqdn":"cashscat.cc","domain":"cashscat.cc","tld":"cc"},"ip":{"addr":"172.67.175.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashscat.cc/","date":"2026-09-02T17:43:28.267Z","timestamp":1788371008267,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashscat.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 22 Aug 2026 00:22:00 GMT","end":"Fri, 20 Nov 2026 01:20:48 GMT"},"fingerprint":{"sha1":"58:39:C7:A3:93:7D:7A:39:05:E2:C6:09:F7:5D:51:A1:AD:35:76:D4","sha256":"5D:4B:6A:B9:08:0B:3F:03:20:0E:B2:CC:03:CE:84:77:7A:58:AA:A4:A2:20:4D:4F:07:82:03:61:0A:8B:42:C2"}}},"request":{"raw":"GET /_next/static/media/24f6455c18489ce9-s.p.woff2 HTTP/1.1\r\nHost: cashscat.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cashscat.cc/$CASHCAT%20%E2%80%94%20They%20Called%20It%20Cash%20Cat%20First_files/5cf55fc5fc3ccdd6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 02 Sep 2026 17:43:28 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 22 Aug 2026 02:17:16 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vY%2BUKQ0%2FeUePWvjnNkek9%2F5dwQE3l92uLJws5VWKAF%2BjJUKTw2QT1ActzZFyrySPn5IZhWkwVG2WQLv4MQ%2BCp43ALUZVD1fhe2%2BvpGavw1%2FP0Weg%2Fls9J3uKg9FEVQ%3D%3D\"}]}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=3,i=?0\r\nage: 2391\r\nvary: accept-encoding\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a34e5131ac610731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24722,"size_decoded":25623,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1028)","md5":"b8d15e97314f9a03cfb5f5190470be65","sha1":"2791b08aa063371a0cd04523856aafa3e1f978fe","sha256":"ac56bf85db142b82fb0b5b60de7155a2ecdc4d38f7c098463610c72ad5987fe8","sha512":"72229a25aa71c46c36bf47ebe2f40566c54b3b2f1c26ec7aad5e67e547f019a93c9f0e175da3e25a4e230413c01dd34a1438e524d3d80efb9fd8a00cac14d0c6","ssdeep":"384:aggx04YxhOFFJxV2SqKOZqZmSoKFqGSf+r1fM:YurEJ2iOk2Bc0","tlshash":"78b2d5a581f242731893e0d46b9b239e6f91d40bd9860a417aed0bd80fc3fd1e8934db","first_seen":"2026-09-02T17:05:31.053767Z","last_seen":"2026-09-02T17:44:26.451075Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-02","alert":"Detects file containing Telegram Bot API","trigger":"cashscat.cc/_next/static/media/24f6455c18489ce9-s.p.woff2","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"cashscat.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-02","alert":"Phishing Block","trigger":"cashscat.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}