# PhishDestroy domain threat record: blackmanpaw.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/blackmanpaw.net/
Machine-readable companion: https://phishdestroy.io/domain/blackmanpaw.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 13:44:27 UTC
- Last availability or vendor check: 2026-10-26 13:49:36 UTC
- Stored record updated: 2026-10-26 20:15:40 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 93.152.212.164
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED

## Evidence links

- URLScan report: https://urlscan.io/result/01a17878-8bb5-71ce-9131-6fde294d9ae1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/blackmanpaw.net
- Certificate Transparency search: https://crt.sh/?q=%25.blackmanpaw.net
- Web Archive lookup: https://web.archive.org/web/*/https://blackmanpaw.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 showed an error page reading This blackmanpaw.net page can't be found, with the line No webpage was found for the web address, HTTP ERROR 404 and a Reload button. No form, offer or impersonated brand was visible in that capture. PhishDestroy listed the domain after fresh registration combined with redirect and spam signals, first seen on 2026-10-26.

How the scam works
The domain was created on 2026-10-25 and the captured root returned an error shell while a redirect path on the same domain routed arriving visitors toward content hosted elsewhere. As a category risk, this pattern takes recipients from a shared message to a landing page they could not see up front, which is commonly used for credential harvesting and deceptive offers. The error shell also lets the operator swap or time-gate the real payload behind specific paths.

Evidence
The screenshot shows the HTTP ERROR 404 shell, the not-found text and the Reload button. VirusTotal was not flagged as malicious, although Fortinet labelled the domain spam. On 2026-10-26 urlscan engines returned a malicious verdict with an ML score of 67 for the redirect capture while the overall urlscan verdict and a separate root capture were clean; Spamhaus DBL listed the domain as spam, OTX carried 3 pulses, PhishDestroy's internal blocklist flagged it, external blocklists recorded 0 listings, and Google Safe Browsing was not flagged. Inspection retained a canvas-based runner-game script with globals such as getRandomNum, RunnerClasses and decodeBase64ToArrayBuffer, no analytics or tracker globals, and document hashes for pivoting beginning 04d05978fdb1.

Infrastructure
Notable weaknesses lead: no Content-Security-Policy, no HSTS or strict-transport, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy, no Permissions-Policy and no COOP, COEP or CORP headers; no SPF, DKIM or DMARC email authentication; DNSSEC unsigned; CAA present. TLS 1.3 with AES-256-GCM, forward secrecy and ALPN http/1.1. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-25, using Cloudflare nameservers and an nginx/1.27.5 server banner.

What to do
Anyone who entered credentials or personal data through a link to blackmanpaw.net should change that password on the genuine service they meant to reach, enable two-factor authentication and watch for follow-up messages. Defenders should block blackmanpaw.net at DNS, proxy and mail layers, keep it on blocklists, and track the same registration pattern and redirect paths.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17878-8bb5-71ce-9131-6fde294d9ae1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/251943ce-526d-4b89-826f-9420133da656
Stored capture screenshot: https://i.ibb.co/0kYGdnh/7e5f47e77888.png
Cloudflare Radar screenshot (2026-10-26T13:47:33Z): https://screenshots.phishdestroy.io/cf/251943ce-526d-4b89-826f-9420133da656.png
URLScan screenshot (2026-10-25T22:09:00Z): https://screenshots.phishdestroy.io/us/01a1751c-0912-7510-95f9-f7ae0d7c795a.png
URLScan capture report: https://urlscan.io/result/01a1751c-0912-7510-95f9-f7ae0d7c795a/
URLScan screenshot (2026-10-26T13:45:55Z): https://screenshots.phishdestroy.io/us/01a17875-d039-71ec-8862-fb19cb4cb959.png
URLScan capture report: https://urlscan.io/result/01a17875-d039-71ec-8862-fb19cb4cb959/
VirusTotal report: https://www.virustotal.com/gui/domain/blackmanpaw.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blackmanpaw.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:15:40 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/0kYGdnh/7e5f47e77888.png
  Captured: 2026-10-26 13:49:36 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17878-8bb5-71ce-9131-6fde294d9ae1.png
  Captured: 2026-10-26 13:49:36 UTC
  Source report: https://urlscan.io/result/01a17878-8bb5-71ce-9131-6fde294d9ae1/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a1775e-c036-7309-9493-334513935773.png
  Captured: 2026-10-26 13:44:27 UTC
  Source report: https://urlscan.io/result/01a17878-8bb5-71ce-9131-6fde294d9ae1/
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1751c-0912-7510-95f9-f7ae0d7c795a.png
  Captured: 2026-10-25 22:09:00 UTC
  Source report: https://urlscan.io/result/01a1751c-0912-7510-95f9-f7ae0d7c795a/
  SHA-256: c0d4133d6cd7a7bfe319e4bb223de4afc2fa62eb847a03fa9eee493cffba3d38
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17875-d039-71ec-8862-fb19cb4cb959.png
  Captured: 2026-10-26 13:45:55 UTC
  Source report: https://urlscan.io/result/01a17875-d039-71ec-8862-fb19cb4cb959/
  SHA-256: 11efaa03c7c619239f0fff1d3cb45575af85e45f463fdaa677658ab1480b6755
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/251943ce-526d-4b89-826f-9420133da656.png
  Captured: 2026-10-26 13:47:33 UTC
  Source report: https://radar.cloudflare.com/scan/251943ce-526d-4b89-826f-9420133da656
  SHA-256: 9fcd0197a5260c7e1521ca48e7c8704ba7f78972e36a255cc263a0a8ca9ae9a5

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T14:18:11Z",
        "uuid": "01a17878-8bb5-71ce-9131-6fde294d9ae1",
        "scanned_at": "2026-10-26T13:48:54Z",
        "final_url": "https://blackmanpaw.net/w/iwiXJizys",
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 0,
        "apex_age_days": 0,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 67,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T13:48:16Z",
        "uuid": "251943ce-526d-4b89-826f-9420133da656",
        "scanned_at": "2026-10-26T13:47:33Z",
        "final_url": "https://blackmanpaw.net/",
        "status": 404,
        "history": [
            {
                "url": "https://blackmanpaw.net/",
                "status": 404
            }
        ],
        "dom_hash": "4dbc72dffccc8f8b936ed5c6039471f9fdd0adc6168a644b2f27e26a223c4772",
        "doc_hash": "15dcd6c146f0e069afb5b17ee9addcb16052b3c91403768b0ccad30b67e0ac4d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "blackmanpaw.net",
                "type": "A",
                "value": "93.152.212.164"
            }
        ],
        "dnssec_valid": false,
        "ip": "93.152.212.164",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-25T18:05:29Z",
            "updated": "2026-10-25T18:05:30Z",
            "expires": "2027-10-25T18:05:29Z",
            "nameservers": [
                "johnny.ns.cloudflare.com",
                "zainab.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T14:19:03Z",
        "analysis_at": "2026-10-26T14:07:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 40
        },
        "detections": {
            "Fortinet": "spam"
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-25T18:05:29Z",
        "expires": "2027-10-25T18:05:29Z",
        "updated": "2026-10-25T18:05:30Z",
        "first_seen": "2026-10-25T18:11:47Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "93.152.212.164"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "zainab.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "johnny.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "johnny.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-26T14:08:05Z",
        "jarm": "1dd40d40d00040d00042d43d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "blackmanpaw.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5f3f0781008f211fc8dad11709071ff4762",
            "sha256": "204e541facc5b8f37e2f5a3d05bb72c2fb0351a106f890f9600af7f91d1d162a",
            "subject": "blackmanpaw.net",
            "valid_to": "2027-01-23T18:47:42Z",
            "valid_from": "2026-10-25T18:47:43Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-25T18:05:29Z",
            "updated": "2026-10-25T18:05:29Z",
            "expires": "2027-10-25T18:05:29Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "johnny.ns.cloudflare.com",
                "zainab.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-25T18:05:29Z",
                "registration": "2026-10-25T18:05:29Z",
                "registrar expiration": "2027-10-25T18:05:29Z",
                "last update of RDAP database": "2026-10-25T18:11:36Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T13:48:36Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "blackmanpaw.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.186",
                    "host": "johnny.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.149",
                    "host": "zainab.ns.cloudflare.com"
                }
            ],
            "zone": "blackmanpaw.net"
        },
        "location": {
            "ip": "93.152.212.164",
            "asn": "207043",
            "org": "Dedik Services Limited",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "blackmanpaw.net"
        },
        "dns": {
            "A": [
                "93.152.212.164"
            ],
            "NS": [
                "johnny.ns.cloudflare.com",
                "zainab.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"johnny.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418452154, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "93.152.212.164",
            "family": 4
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-25T18:05:29Z",
            "updated": "2026-10-25T18:05:30Z",
            "expires": "2027-10-25T18:05:29Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "johnny.ns.cloudflare.com",
                "zainab.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.27.5"
            }
        }
    }
}
```