{"report_id":"ec431355-6a17-44d6-b887-7770bf2b4b56","version":0,"status":"done","tags":[],"date":"2026-07-24T12:00:48Z","url":{"schema":"https","addr":"blacktds.pro/","fqdn":"blacktds.pro","domain":"blacktds.pro","tld":"pro"},"ip":{"addr":"172.67.154.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"blacktds.gold/","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"title":"ANTIBOT BLACKTDS GOLD selection - Cloaking Antibot TDS - the BEST for Cleaning traffic from bots and dirty trafic","dom":{"size":75384,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (36250)","md5":"b3b8bc4bc5b9de14eb0054a9bf224cb1","sha1":"c3cede0e5e1363eaee017bb520314d54f3d9e52d","sha256":"2b6b30303375fc8f04d9994b31bf5b55c125aa02124c6675ac4ebd8f80a630ed","sha512":"d7ef65c27ee33fc05e199002619e91a051c0cd8c66eb80ad909b62759f97fd8eb75fe538ba92dbd88a8c0fe35b34274215f59a2c8fde7fef0323e1cf63a48fd4","ssdeep":"1536:z7A8ADLUqch6DUH+klLRUYAXV0hFCHnOtf2QwvF7mhrwJQERcjklf+V6tGT0Eyg:z7A8A1UH+klLRUYAXV0hFCHnOtf2QwvY","tlshash":"d4730a6385c0311c91338662f7ca9f5c27384267e67368eeba664859c78b7d8133379b","dom_hash":"domhash7063af309b54e85afcbfc182774f74ff","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"blacktds.pro/","fqdn":"blacktds.pro","domain":"blacktds.pro","tld":"pro"},"ip":{"addr":"172.67.154.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-28T12:00:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-19T22:19:42.520021Z","alert_count":0,"request_count":2,"received_data":45362,"sent_data":1091,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-19T22:23:13.155676Z","alert_count":0,"request_count":1,"received_data":10950,"sent_data":556,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"blacktds.pro","ip":{"addr":"172.67.154.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-24T12:00:49.13392Z","last_seen":"2026-07-24T12:00:49.13392Z","alert_count":1,"request_count":1,"received_data":646,"sent_data":481,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"shield.sitelock.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2000-11-21","domain_rank":674266,"first_seen":"2012-07-12T10:25:01Z","last_seen":"2026-07-19T23:24:30.497977Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":551,"comment":"","tags":null,"fingerprints":null},{"fqdn":"blacktds.gold","ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-25T13:21:52.797796Z","last_seen":"2026-04-09T23:40:08.728439Z","alert_count":16,"request_count":8,"received_data":362493,"sent_data":3912,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"blacktds.gold/bt/js/modernizr.sjs","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb603576e7edee7f7436fed2a446b31f","sha1":"c81ddaf7c059eee8fa2bf20277002299596ba620","sha256":"d07bf1fe9ee99ef8c6289a9bee55116f3e7f0c9be1e05d47caa741f133146461","sha512":"3ab94ab9915743f22c2554790b54408f9b5ee25a24f5ef8cd55acc4f095576ea0013cb933dbf175bd982f9901a9d89070cdacc596723c863904351f9c0222cf3","ssdeep":"192:vDCM2XKQob1dHYPeIny6ZLDDhWwpy8b7z:vmJXKQoZRY5y6xHh1pz","tlshash":"22f1c8c87642f21787a710ba907f460bf274a4aae85c4d50e055d9f8bd709b8463bf2e","size":7648,"data":"","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.62217Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/my.scr","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"98d4498a4bb98678644b6f9fdf8a6f6e","sha1":"41c8cbd771da3b9c0c30fb43cb6c24cc3c9db349","sha256":"c9922a759597ca2876f1325ea31bc6c93b8a619af4914c6f26a58cb54039f1fb","sha512":"2ef499e72f98e87ae5254e2b9f4d5c33762cec171e17992c507bbdff3244ba343e1c50e7ad2140c755a6d6b61cbf24468cc1272faa08dd178647414ccd3e373f","ssdeep":"192:o4ajMyVxrV1TBYpnqVyITObXN/XNE4WN4uVXN3XNVRG:+jMyVxrV1TBYpnqVyITORlE4i4ItjG","tlshash":"48d19d5332572630d7ab4b6f08ae6b8c3534a06a5e43f05178adb5316855ecf807fb98","size":6203,"data":"","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.616515Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/bt/js/main.sjs","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5cce2f66aff4644545b7c4d9bc359a9","sha1":"8fae8c0f2a7145617b560e794f80f671ae0c6a17","sha256":"32ce2a57cab2d9b5eb985095461f528d35ac9ff75321532c4c7ae06afae5621a","sha512":"ff19f8c4c3a05357c52bd2660d67b7be4833df53862bb3d757dcd49d9be504b9c4e776f5e1237abf1fd3874942f4fb41c58c7a63248162ef45276e25f0d55ae8","ssdeep":"3072:e+41ZqLTW8xRrqSb8aGH77da98Hr+Rb9TVT54/G+v:vOoW8xVdkda98Hr4Bl54/G+v","tlshash":"9904e9c8bf92716296b7b0b8506f510bf1769895b4088878b0acc4d47eb8e88517ff7d","size":185842,"data":"","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.620564Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"shield.sitelock.com/shield/blacktds.gold","fqdn":"shield.sitelock.com","domain":"sitelock.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.152Z","timestamp":1784894422152,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shield/blacktds.gold HTTP/1.1\r\nHost: shield.sitelock.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T05:24:08.89467Z","times_seen":17540032,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/images/mario.gif","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.154Z","timestamp":1784894422154,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /images/mario.gif HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncontent-type: image/gif\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 23 Apr 2025 21:11:19 GMT\r\npriority: u=5,i\r\netag: \"68095777-a863\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nage: 2219\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=se69bI%2B%2BUdLBrG6H99YUGOdpP2aj9pGq5RcQQ%2BwsTibzPlB5518yds5SB%2FyeOjO6YroZkAXifkwys93Lq0pdV8TWTLebX1%2BOsSh1aNV98xu2zLwNWCYEKKuJ0Pmvcnv2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a7a5cdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 43107\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43107,"size_decoded":43850,"mime_type":"image/gif","magic":"GIF image data, version 89a, 124 x 128","md5":"1daa85add381399ca5cd5416696a2df6","sha1":"d1f41bf1e6e5ddf7f49c99591d14acec1fc1503b","sha256":"84ee273f9248c5630feac1bac2a245d7b6a53b5fef4208ebbfca32891bb4ce66","sha512":"43817e601aecece80089d215c8a63e1d00fced564f9ca0d443117e7aa268da3b589c1ad4383349b20f792240884447868ea5e15ec61e51a567cc01ec2992edc9","ssdeep":"768:m/Kc9CvL31GDuKq9yHLupZMnKK1QJio3ZMJrwCHOwkM9i3xRtszsW:mx9osuKSuLAMnKKSkcCeTmzsW","tlshash":"c013d0efe591d3b1ec17817802732e8b8b651eb984015cd5c36ca2e50c8b137aedd9d8","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.617342Z","times_seen":9,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/bt/js/modernizr.sjs","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.140Z","timestamp":1784894422140,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /bt/js/modernizr.sjs HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\nserver-timing: cfExtPri\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 23 Apr 2025 21:11:19 GMT\r\netag: \"1de0-633788ae27c68\"\r\naccept-ranges: bytes\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rtwb%2BJvWTZ5h%2FZrgcjaQUglIwTa9ZT2TadJprVrBDmGo9HOHFzPOB7Y%2BNmrUt1rRiAGnxHvZDjaDJxIHi8UdGq2sIq3uFGHOZeiLO7rgERqqWLCG7gGy0%2F4mzwu6gEh6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a5a57dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7648\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7648,"size_decoded":8416,"mime_type":"text/plain","magic":"JavaScript source, ASCII text, with very long lines (7648), with no line terminators","md5":"fb603576e7edee7f7436fed2a446b31f","sha1":"c81ddaf7c059eee8fa2bf20277002299596ba620","sha256":"d07bf1fe9ee99ef8c6289a9bee55116f3e7f0c9be1e05d47caa741f133146461","sha512":"3ab94ab9915743f22c2554790b54408f9b5ee25a24f5ef8cd55acc4f095576ea0013cb933dbf175bd982f9901a9d89070cdacc596723c863904351f9c0222cf3","ssdeep":"192:vDCM2XKQob1dHYPeIny6ZLDDhWwpy8b7z:vmJXKQoZRY5y6xHh1pz","tlshash":"22f1c8c87642f21787a710ba907f460bf274a4aae85c4d50e055d9f8bd709b8463bf2e","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.62217Z","times_seen":19,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/oswald/v16/TK3iWkUHHAIjg752GT8G.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.327Z","timestamp":1784894422327,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/oswald/v16/TK3iWkUHHAIjg752GT8G.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://blacktds.gold\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 15248\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 13:20:09 GMT\r\nexpires: Thu, 22 Jul 2027 13:20:09 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 07 Nov 2017 15:18:45 GMT\r\ncontent-type: font/woff2\r\nage: 168013\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":15248,"size_decoded":16061,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15248, version 1.0","md5":"f15aa285863274b4f6ed578caa76565e","sha1":"b77b6b036b58682647f75fce1668e2bb352357db","sha256":"b038dfedc262406996d21b97425bf6f36b77c82ab12e23aaf55e7e822bf3a866","sha512":"fe82ca17ab32590a2af830610a7b68d57d77e9226420503db66f02bc68f6b1e5b3450c39ee47f856e64cd086f10abd0176f8dde3692bf524099677a34165ca5a","ssdeep":"384:vdkTj88xgfHpohE3hKnp2lIE6r1wQ4zgJw+iTPVbN:4j88xgChsTlIE6r1ME/iRJ","tlshash":"d462d0dcd617891cc0673834d24ed093a847ceb765fe842a260e0153e5e5a32bd69bcd","first_seen":"2023-04-07T23:35:47Z","last_seen":"2026-07-24T12:02:56.619507Z","times_seen":254,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":3,"connect":31,"send":0,"wait":16,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/oswald/v57/TK3iWkUHHAIjg752GT8G.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.328Z","timestamp":1784894422328,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/oswald/v57/TK3iWkUHHAIjg752GT8G.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://blacktds.gold\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28488\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 23 Jul 2026 05:54:19 GMT\r\nexpires: Fri, 23 Jul 2027 05:54:19 GMT\r\ncache-control: public, max-age=31536000\r\nage: 108363\r\nlast-modified: Wed, 10 Sep 2025 16:46:11 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":28488,"size_decoded":29301,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28488, version 1.0","md5":"22c3b00d2e65fb2c876a292423108958","sha1":"3c61d84659817fef687045bbfa0e1da9568e164b","sha256":"bd73278ee0c50041b91b4c03d1229e35b501637f46b6409e7da2d3a758446ea5","sha512":"33954d8a7ed3c87b3af8577bbae9439b9efba2a64445463d893681dad085bb8630d31c995ce010510a9c732926017dba9d5fd5002d0000ec1488b61889d6ddfe","ssdeep":"384:jlzdJfoB5YJ2kG1CdQegm8m00xr19KB668/BOTqE85gyqvPA34uEomcGvpMwvg84:jlzdyBzhIb0u1QB6vBOv8uvPAovJCs4","tlshash":"cfd2e0195e9673efe4552d3ea830affe91e32aad30507162c5db6c1155c438bc8e4ec4","first_seen":"2025-09-11T19:05:43.498829Z","last_seen":"2026-07-26T04:54:44.80923Z","times_seen":33337,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":32,"dns":0,"connect":0,"send":0,"wait":17,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/bt/js/main.sjs","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.144Z","timestamp":1784894422144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /bt/js/main.sjs HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\nserver-timing: cfExtPri\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 23 Apr 2025 21:11:19 GMT\r\netag: \"2d5f2-633788ae27c68\"\r\naccept-ranges: bytes\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=izDFccwBrkCGiFBH1y6DKCGda6e%2FXTklhRbYkfoTSN%2B%2BJTtZ1sXmSeo1RRS2PuIaynAjk6OMLGjqEwu9JFx43REFa7oApDvYPnjcVk5p2UkrAlf8ZqUKnsIoUGJ0Xag4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a6a59dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 185842\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":185842,"size_decoded":186611,"mime_type":"text/plain","magic":"JavaScript source, ASCII text, with very long lines (65342), with CRLF line terminators","md5":"d5cce2f66aff4644545b7c4d9bc359a9","sha1":"8fae8c0f2a7145617b560e794f80f671ae0c6a17","sha256":"32ce2a57cab2d9b5eb985095461f528d35ac9ff75321532c4c7ae06afae5621a","sha512":"ff19f8c4c3a05357c52bd2660d67b7be4833df53862bb3d757dcd49d9be504b9c4e776f5e1237abf1fd3874942f4fb41c58c7a63248162ef45276e25f0d55ae8","ssdeep":"3072:e+41ZqLTW8xRrqSb8aGH77da98Hr+Rb9TVT54/G+v:vOoW8xVdkda98Hr4Bl54/G+v","tlshash":"9904e9c8bf92716296b7b0b8506f510bf1769895b4088878b0acc4d47eb8e88517ff7d","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.620564Z","times_seen":8,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-24T12:00:12.254Z","timestamp":1784894412254,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 24 Jul 2026 12:00:21 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nset-cookie: authlangs=en; expires=Tue, 28-Jul-2026 12:00:15 GMT; Max-Age=345600\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=am0PlHsOGZgfq%2FlqAtIAtxPhF5dWcHAdC%2BvFZI5UVr5LuR1nXbnnNepB6nRFoM6D2qwWUPBPzVTuli6LB9CepC0GOWc67PrDu5IszyZlWMUqxDSs%2FkLwn5BeLGose3mp\"}]}\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=7,cfOrigin;dur=6041\r\ncontent-encoding: zstd\r\ncf-ray: a202c370d92b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76083,"size_decoded":17960,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (36250), with CRLF line terminators","md5":"135b5272545096dfab1bc8549f0ee3ad","sha1":"ebc66c3acbffc15d887ba8912aa0e5730b8d3d54","sha256":"b90bd9a5844ff552a40b54c3fee9b427e39a9b9bf2017ecf1b9d0394c7eff8ad","sha512":"4ef9967046fcf5b0c53f0d30e1a6b5a6746214be314f8009b6c6a21ff167d4776c0e66e2803ceedce49b4275b446a8b9e30966ea0e84c43c560dd0da5d6e7e2c","ssdeep":"1536:+7mYGLUqch6DUH+klLRUYAXV0hFCHnOtf2QwvF7mUrwJQERcjbSpspO8Dwq5:+7mYyUH+klLRUYAXV0hFCHnOtf2QwvFN","tlshash":"4f731c6385c0351cc1338672e6ca8b9c77384257d73368eeba66585ac78b798037379b","first_seen":"2026-07-24T12:00:53.584955Z","last_seen":"2026-07-24T12:00:53.584955Z","times_seen":1,"resource_available":true,"data":null}},"time_used":9301,"timings":{"blocked":-1,"dns":78,"connect":1,"send":0,"wait":6060,"receive":0,"ssl":3162},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700\u0026subset=cyrillic,latin-ext,vietnamese","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.133Z","timestamp":1784894422133,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css?family=Oswald:200,300,400,500,600,700\u0026subset=cyrillic,latin-ext,vietnamese HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 24 Jul 2026 12:00:22 GMT\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10266,"size_decoded":1355,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"a1cc133a90e2f42bb150b6ea0c9f97df","sha1":"912fafb9971d50766d230f50b12bfc0cbdced24b","sha256":"fafd26cfa100cec90090a795113bad5efa34c33aa87360e129683e9c307cf395","sha512":"dfa1107b195ec23d0f48a041f4df71263a5146946b7add9368fc9158b3e4ed3a4e9ea9599ab44c82c49f7c4da65f98227598558bd2e1be11cfc971498672648e","ssdeep":"192:3KHLcfh9mKcLH0habK9La1hHwKaL9yhcVKDL47hBSK4LDQhOt:6rWuc1So0HG6X","tlshash":"4322aea2042fa4806f471cc533cf3d329e8ea24574518975affd1ca8dca6e216369b4d","first_seen":"2025-09-14T23:19:29.11902Z","last_seen":"2026-07-25T12:12:40.061088Z","times_seen":1570,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":35,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/style.css?11_0","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.138Z","timestamp":1784894422138,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /style.css?11_0 HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 23 Apr 2025 21:11:19 GMT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\netag: W/\"68095777-3740\"\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2b1N%2BF19RGTRAj2xvoZlfpWO%2B1JDLC83v0y9aLjnRXN5ejvZzuQYBxCWTXYs5c7wxxJfDlg3F%2F2pBOlklpVdLfKxlIHJynJZdygKQr1f0lVavrXegDdMbRiwuuaesuVy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a5a56dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14144,"size_decoded":3975,"mime_type":"text/css","magic":"ASCII text, with very long lines (377), with CRLF line terminators","md5":"0b231a39d6aa1e114e4515ed4d50f38c","sha1":"18717b8184fd046be0e776bdd18e92fa062b040c","sha256":"506c69ea9adaa7f453b89d8772fccd1dd9b768dc21e50385a213e8b8ad332eca","sha512":"4ee9a7e93b59794f0006525fc8160d155e9735fe5c44cb1f3f2405fc8d9db4d54b9eb4ca0691b00ccbf17ed8cfbaaeefe4944aaf23da8bc6d2a0871d1b6c3f6e","ssdeep":"192:M64nYFRaEPgaDX0M6KlwPSyNL4tYiNE1OCyyVdIp4g0Yc5MGBfxxD:/NhwPNNcK86OCyyo5c5vxD","tlshash":"fc52b92232c690d87113d39ab05397a83c7f8116a61b356db45a3764c6cb6a7d33378f","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.61806Z","times_seen":8,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/my.scr","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.142Z","timestamp":1784894422142,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /my.scr HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncontent-type: application/x-silverlight\r\nserver-timing: cfExtPri\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 23 Apr 2025 21:11:22 GMT\r\netag: \"183b-633788b0fc632\"\r\naccept-ranges: bytes\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FH%2FtrgUjJiWRXj8BmfYbWaUK8TDCItt5QuNsyP6zatuqmdOmxrYqKCKxERhoMSPOP8HaHd8zM%2BE6r9pkpgvHsYanDsBVMdgVokTEuvqAHzY4UW4ewyjvFYUl0fhH2LfE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a6a58dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6203\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6203,"size_decoded":7010,"mime_type":"application/x-silverlight","magic":"ASCII text, with very long lines (6203), with no line terminators","md5":"98d4498a4bb98678644b6f9fdf8a6f6e","sha1":"41c8cbd771da3b9c0c30fb43cb6c24cc3c9db349","sha256":"c9922a759597ca2876f1325ea31bc6c93b8a619af4914c6f26a58cb54039f1fb","sha512":"2ef499e72f98e87ae5254e2b9f4d5c33762cec171e17992c507bbdff3244ba343e1c50e7ad2140c755a6d6b61cbf24468cc1272faa08dd178647414ccd3e373f","ssdeep":"192:o4ajMyVxrV1TBYpnqVyITObXN/XNE4WN4uVXN3XNVRG:+jMyVxrV1TBYpnqVyITORlE4i4ItjG","tlshash":"48d19d5332572630d7ab4b6f08ae6b8c3534a06a5e43f05178adb5316855ecf807fb98","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.616515Z","times_seen":8,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/abstract.jpg","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.156Z","timestamp":1784894422156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /abstract.jpg HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 23 Apr 2025 21:11:19 GMT\r\npriority: u=5,i\r\netag: \"68095777-5997\"\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JZzsEDLwDc%2FMlj5XjMExQ%2FsZ6TFbLuSwqzaV0HlttEhgXmVr1oyWzAsPaXJ8TxNVrAbgfriF%2BdXVbV1zquD7sHj95MBkHBN%2B57HrultotjsTCSHfce%2FYV2Hb88F6BRpy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a202c39a7a5fdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22935\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22935,"size_decoded":23669,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 251x201, components 3","md5":"23a13b3ebabcd77577ccc50edfd0e769","sha1":"42509e6b1719210810e663e0c462ca5c51d8e5a9","sha256":"f17cb8d3a3ad7140a1b9423cfaa96c26700d9249d528a1d2be0c5dc11f113ca7","sha512":"b50ccc74084437c4992731c5cda399ec6efceb06e9aa7c1025ee0212c2712e2c0db2c1ea02290f471202cb0c540afb1f1060d036eeddd7150687dba099593049","ssdeep":"384:neJ5gpBpgmYp1JIN3xyGzfBYbTym21wIT+JPJ0XsrWjMhbA4+6cbvxODl227uU:ni50GtE3x114l2SIT+JPisqjUg6cbvvg","tlshash":"7ca2e038deae3ad059c969701384077b83a09590284d352d565c2faf1cf2a3bedcd3a9","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.6188Z","times_seen":8,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.gold/favicon.ico?9","fqdn":"blacktds.gold","domain":"blacktds.gold","tld":"gold"},"ip":{"addr":"172.67.136.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://blacktds.gold/","date":"2026-07-24T12:00:22.519Z","timestamp":1784894422519,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.gold","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 09:34:16 GMT","end":"Sun, 18 Oct 2026 10:33:54 GMT"},"fingerprint":{"sha1":"3C:4A:FC:94:38:27:10:74:49:B7:08:CF:D4:AC:86:E8:E9:00:5D:7B","sha256":"F3:DE:15:63:9F:AA:86:D3:17:3C:8F:11:22:0C:2A:15:EB:F0:D4:47:5F:69:CD:39:D9:A9:50:9A:E1:90:AC:DC"}}},"request":{"raw":"GET /favicon.ico?9 HTTP/1.1\r\nHost: blacktds.gold\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://blacktds.gold/\r\nCookie: authlangs=en\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:22 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LnBThevNK0Kg%2BdH8csOz2eJ1C7frwcWOaSL1moSuHC9uhv4w3ncFPDuHo7mK7zCBouWKcbrDO09Fip4Kpc%2B42nSjB%2F2MQWKi%2Fi%2BMJIrRVtm4y1luqqycEdchcMYbaAUQ\"}]}\r\nexpires: Thu, 1 Jan 1970 00:00:00 GMT\r\npragma: no-cache\r\ncache-control: max-age=0, no-cache, no-store, must-revalidate\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: BYPASS\r\ncontent-encoding: zstd\r\ncf-ray: a202c39cbac6dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":354,"size_decoded":1116,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"f75fab83cb873bf2a7447aad30425911","sha1":"a6881c4ebb60f78bf73c58aff8ca4f8aebdf8e70","sha256":"35335120d6b72623ca6cce33b8498a80c83bc917fa1f08f4580472ce3c472cc6","sha512":"ea75c1d0af8665dccbe88542110795feb163360ffe15697ab84536528f4992f0d0f60b2914b1a577e7630f2e917940bd518d1b927b544277026e137db10970aa","ssdeep":"","tlshash":"f3e060b3371e2c68d3af1026cf39a0224f7b064c33941355c200482c99c1fca11a46c2","first_seen":"2024-09-03T21:56:22Z","last_seen":"2026-07-24T12:02:56.615099Z","times_seen":8,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.gold","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"blacktds.pro/","fqdn":"blacktds.pro","domain":"blacktds.pro","tld":"pro"},"ip":{"addr":"172.67.154.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-24T12:00:12.029Z","timestamp":1784894412029,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blacktds.pro","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 18 Jun 2026 12:25:36 GMT","end":"Wed, 16 Sep 2026 13:25:32 GMT"},"fingerprint":{"sha1":"14:F3:11:32:D9:96:D2:10:99:10:ED:A0:BF:7E:FB:CD:F0:8E:EA:C3","sha256":"2E:75:55:6A:CC:BA:2A:B4:54:0F:B1:9B:CE:EA:79:3F:13:8B:85:64:0E:F5:C7:CC:D1:BF:EE:66:4E:5A:4F:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: blacktds.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 \r\nserver: cloudflare\r\ndate: Fri, 24 Jul 2026 12:00:12 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\nlocation: https://blacktds.gold/\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LgiYX%2Bei9spZr6sm6bTtknPhXg2ZaqeYBJk5OPSOPOzcVxZezD7eTU%2BIahU85dHjnb57zjuNwbzpwL1BBiZOtBjLYh7TTyQ%2F7GBRqqDV90fAnyYE7%2FoZ4Yw5SSzNQx0%3D\"}]}\r\ncf-ray: a202c35bc8065685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T05:24:08.89467Z","times_seen":17540032,"resource_available":true,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":72,"connect":22,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-24","alert":"Sinkholed","trigger":"blacktds.pro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}