{"report_id":"8eb743db-d2d9-498b-a7a5-ace7d341fb9d","version":0,"status":"done","tags":[],"date":"2026-08-08T01:06:19Z","url":{"schema":"http","addr":"login-east3.cashappps.com/ca","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"3.229.204.77","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"login-east3.cashappps.com/ca","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"title":"Cash App","dom":{"size":6923,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3829)","md5":"71c36bd5ed2f5318c7344103dc0d739b","sha1":"b4963ebc69cf1fa2142fcbf3cf1ede18cb02e733","sha256":"75d3161e8cf1315b2ae96315236393c9364de29e6994db6c617978a6771820e1","sha512":"d84893628f8bcc0d3e7d8193102463ae9c8cbaf21a8c44db7cd84fed87085868834ee0fef1bad17ab2a969335e3e2e1c98ccb4a5de2c2b95a69e9961ffb82761","ssdeep":"192:jrnhJQ8VRRFK51VEKcfyKgl51VEfs5v/+p9G3rcGj:88VRRFKXORfyKglXOk5v/+pycE","tlshash":"fce1c825c58a31ab0d30784efa75e44d7414939293064b94fbde4deedb0f6331a972ac","dom_hash":"domhash92b4d6145df8c941a4df7622cee6abaa","first_seen":"2026-06-13T17:48:58.820723Z","last_seen":"2026-08-08T05:33:03.43154Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"login-east3.cashappps.com/ca","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"3.229.204.77","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-12T01:06:19Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-08","alert":"Phishing Block","trigger":"login-east3.cashappps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"login-east3.cashappps.com","ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2024-05-07","domain_rank":0,"first_seen":"2025-10-23T00:08:04.103065Z","last_seen":"2026-08-07T12:51:06.646944Z","alert_count":9,"request_count":3,"received_data":9182,"sent_data":1499,"comment":"","tags":null,"fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"login-east3.cashappps.com/js/phished_pages/tracking_responses.js","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2829b49d7f3c7458d163640ca5de16ef","sha1":"33c62f1090670d107b7db68f6fa40e4be24b994c","sha256":"7ccbc87f1c7628e4fd187124bd3703f198810e1ab76d599ec47deb9f64529ace","sha512":"ff1de5d8d83f8f03883c82b1450c0b034bd07f2aead980c241044f8a2722017a68a418cab36c31fb3ec84d8c02756158d751838e0bf9cb97344933ffd1efc11b","ssdeep":"","tlshash":"ad214bdf20d4065027e761abca6a7608f13244c719049c417a1d85897f18bafcebee8f","size":1340,"data":"","first_seen":"2025-02-20T02:04:06.151568Z","last_seen":"2026-08-15T14:00:09.892631Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login-east3.cashappps.com/ca","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2f49ff0348cf43b0ac50d76607b67537","sha1":"69cc86f10bc96939487a64ecf2a854ed89c9a7b4","sha256":"fe2978fb28bc85188fc68bd86753ae8418396a9ea23cd4939eebd0f276d71a95","sha512":"460e79a1f1412b72daf0f95d21bd92686fdaf67532d08144892916cbcd7fd22553939f63e21012a2ed03498b1db0d90254af31410e9cd5809516290698cfe069","ssdeep":"","tlshash":"6df03a56518426aa06326488203a18f2b03a1ae2d15c0aa5fb5e4dee074efb1a3f2895","size":534,"data":"","first_seen":"2026-06-13T17:48:58.824642Z","last_seen":"2026-08-08T05:33:03.439478Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"login-east3.cashappps.com/ca","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-08T01:05:52.900Z","timestamp":1786151152900,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.cashappps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 29 Mar 2026 00:00:00 GMT","end":"Mon, 12 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:34:A1:13:75:CB:5A:75:99:7B:BD:9A:44:BA:B3:0D:E2:66:6F:0C","sha256":"D8:E1:E6:D4:F0:EC:CE:A8:36:71:11:D5:13:14:A2:17:A7:6F:6F:FC:62:55:5F:09:97:9F:A4:24:91:1A:65:AE"}}},"request":{"raw":"GET /ca HTTP/1.1\r\nHost: login-east3.cashappps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 08 Aug 2026 01:05:53 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-powered-by: Express\r\ncontent-language: en-US\r\netag: W/\"1b20-q57RKoTL0LVuBi2TkVRBXFwVSAo\"\r\nserver: HacWare Private\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":6944,"size_decoded":3188,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3830)","md5":"661389004e3021493df586b7018cf6a0","sha1":"ab9ed12a84cbd0b56e062d939154415c5c15480a","sha256":"8bc0a8f2850b419459cf579ec5a46735394bd356c802adb11fd665432222b329","sha512":"c74cc30007d62956503167e85cf5d9b5a53d914f6bcf36a6c10e4ef9f36183dd3e8b0bc87d721b87229c911f905e64b041fddf4e284757e460bd664ab622dc6b","ssdeep":"192:/jnhJQ8VRRFK51VEKcfyKgl51VEfNHN/Cp9G3rlS:48VRRFKXORfyKglXOlHN/CpylS","tlshash":"14e1a825c58a31660d30784efa75e44d7414939293064b94fbdd4deddb0f6331a972ac","first_seen":"2026-03-01T19:31:59.071021Z","last_seen":"2026-08-08T05:33:03.434217Z","times_seen":8,"resource_available":false,"data":null}},"time_used":528,"timings":{"blocked":-1,"dns":53,"connect":93,"send":0,"wait":101,"receive":0,"ssl":281},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-08","alert":"Phishing Block","trigger":"login-east3.cashappps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"login-east3.cashappps.com/js/phished_pages/tracking_responses.js","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://login-east3.cashappps.com/ca","date":"2026-08-08T01:05:53.643Z","timestamp":1786151153643,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.cashappps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 29 Mar 2026 00:00:00 GMT","end":"Mon, 12 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:34:A1:13:75:CB:5A:75:99:7B:BD:9A:44:BA:B3:0D:E2:66:6F:0C","sha256":"D8:E1:E6:D4:F0:EC:CE:A8:36:71:11:D5:13:14:A2:17:A7:6F:6F:FC:62:55:5F:09:97:9F:A4:24:91:1A:65:AE"}}},"request":{"raw":"GET /js/phished_pages/tracking_responses.js HTTP/1.1\r\nHost: login-east3.cashappps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login-east3.cashappps.com/ca\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 08 Aug 2026 01:05:53 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 1340\r\nx-powered-by: Express\r\ncontent-language: en-US\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\nlast-modified: Thu, 29 Aug 2024 11:29:12 GMT\r\netag: W/\"53c-1919de58b40\"\r\nserver: HacWare Private\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1340,"size_decoded":1689,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"2829b49d7f3c7458d163640ca5de16ef","sha1":"33c62f1090670d107b7db68f6fa40e4be24b994c","sha256":"7ccbc87f1c7628e4fd187124bd3703f198810e1ab76d599ec47deb9f64529ace","sha512":"ff1de5d8d83f8f03883c82b1450c0b034bd07f2aead980c241044f8a2722017a68a418cab36c31fb3ec84d8c02756158d751838e0bf9cb97344933ffd1efc11b","ssdeep":"","tlshash":"ad214bdf20d4065027e761abca6a7608f13244c719049c417a1d85897f18bafcebee8f","first_seen":"2025-02-20T02:04:06.151568Z","last_seen":"2026-08-15T14:00:09.892631Z","times_seen":39,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-08","alert":"Phishing Block","trigger":"login-east3.cashappps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"login-east3.cashappps.com/favicon.ico","fqdn":"login-east3.cashappps.com","domain":"cashappps.com","tld":"com"},"ip":{"addr":"18.211.143.84","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login-east3.cashappps.com/ca","date":"2026-08-08T01:05:53.752Z","timestamp":1786151153752,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.cashappps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 29 Mar 2026 00:00:00 GMT","end":"Mon, 12 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:34:A1:13:75:CB:5A:75:99:7B:BD:9A:44:BA:B3:0D:E2:66:6F:0C","sha256":"D8:E1:E6:D4:F0:EC:CE:A8:36:71:11:D5:13:14:A2:17:A7:6F:6F:FC:62:55:5F:09:97:9F:A4:24:91:1A:65:AE"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: login-east3.cashappps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login-east3.cashappps.com/ca\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sat, 08 Aug 2026 01:05:53 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 42\r\nx-powered-by: Express\r\ncontent-language: en-US\r\netag: W/\"2a-acTWo+DAEIMpHDTR+ACssLuOwdM\"\r\nserver: HacWare Private\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":42,"size_decoded":296,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a7c2e1838dc42feb39409200725a988d","sha1":"69c4d6a3e0c01083291c34d1f800acb0bb8ec1d3","sha256":"06ad24b6889a4462ced065739d338a185dfcada4b377bc9b334b37743d62494d","sha512":"5c1b0354fa4f78ad9a333f6228910f18dc3412f7ee3ef59e8cee6ff5176a39db4fe0addfc2b545a02534e3929c9936d86360deb029675b779ba61c7c68ab37b0","ssdeep":"","tlshash":"a890045c5c043f0c1f43115d31443450c30c5dc70d753351104fc4cd43d0d1d0005544","first_seen":"2025-02-20T02:04:06.152784Z","last_seen":"2026-08-15T14:00:09.893428Z","times_seen":38,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-08","alert":"Phishing Block","trigger":"login-east3.cashappps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"login-east3.cashappps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}