Question 1

What is Blackwall?

Accepted Answer

Blackwall is an infrastructure takedown platform that helps identify and disable abusive websites and domains. This includes phishing, scams, fraud, spam, malware distribution, copyright infringement, and illegal content. Our team collects reports from the community, investigates them, and forwards verified cases to hosting providers, domain registrars, and law enforcement for action.

Question 2

Is Blackwall free to use?

Accepted Answer

Yes! The Free plan lets you submit abuse reports (10/hr), track report status, access the Community page (read & like), use direct messaging, and contact support — all at no cost.

Question 3

What plans does Blackwall offer?

Accepted Answer

Three tiers: Free (€0), Pro (€249/mo, up to 10 users) and Enterprise (custom pricing, unlimited). Pro unlocks the full B2B stack — managed takedowns, Evidence Vault, brand radar, OSINT/Zodiac, SIEM/Slack/Webhook integrations, full automation API, 24h SLA and automated triage (rule-based + LLM-assisted). Enterprise adds SSO, custom SLA, dedicated account manager, legal-grade archiving and on-premise.

Question 4

Do I need an account to submit a report?

Accepted Answer

Yes, you need to create a free account to submit reports. This allows us to keep you updated on your report's status and ensures accountability in the reporting process.

Question 5

What should I report?

Accepted Answer

Report any domain or website engaged in abuse — including phishing, scam pages, fraud schemes, malware distribution, spam infrastructure, copyright infringement, or illegal content. We focus on disabling the infrastructure behind these threats.

Question 6

What should I NOT report?

Accepted Answer

Do not report: standalone malware files without an associated website, spam emails (unless they link to abusive sites), websites you simply dislike, legitimate websites you believe were hacked (contact the site owner instead), or well-known legitimate platforms (Google, Amazon, Roblox, etc.) without overwhelming technical evidence.

Question 7

What's the difference between 'Confirmed' and 'Suspected' abuse?

Accepted Answer

Choose 'Confirmed' if you have technical evidence such as file hashes, sandbox analysis, phishing kit indicators, or C2 server addresses. Choose 'Suspected' if you observed suspicious behavior but don't have technical proof.

Question 8

Can I report anonymously?

Accepted Answer

No, all reports are linked to your account email. However, your email is never shared with the reported parties or publicly displayed. Only our team sees your contact information.

Question 9

What evidence should I include?

Accepted Answer

Include as much as possible: screenshots, file hashes (SHA256 preferred), URLs with specific paths (not just the homepage), IP addresses, domain registrar info, log files, and detailed behavioral observations. The more detail you provide, the faster we can act — and the less likely your report is to be rejected by AI screening.

Question 10

How detailed does my report need to be?

Accepted Answer

Very detailed. Our AI triage system automatically evaluates every report and will reject submissions that lack substance. A good report includes: a thorough written description of what happened (at least a few sentences), specific URLs (not just the domain), selected behaviors that match your abuse type, and at least one form of evidence (screenshots, logs, hashes, or evidence links). One-word descriptions, empty fields, or vague claims like 'it's malware' will be automatically rejected.

Question 11

Will my report be rejected if I don't provide enough details?

Accepted Answer

Yes. Our AI screening system scores every report based on the quality and quantity of information provided. Reports with very short or empty descriptions, no evidence files, no selected behaviors, and no technical indicators will be automatically rejected. Always write a detailed description explaining exactly what you observed and why you believe the site is malicious.

Question 12

Can I report well-known websites like Google, Roblox, or Amazon?

Accepted Answer

Reports against well-known legitimate platforms require significantly more evidence than usual. Our AI triage system applies stricter thresholds to these domains — you need detailed technical evidence, specific malicious URLs (not just the homepage), file hashes, screenshots, and a thorough description. Vague reports against major platforms will be automatically rejected. Note: Blackwall's own domain (blackwall.report) cannot be reported at all.

Question 13

How long does it take to review a report?

Accepted Answer

Free-tier reports are pre-screened by our automated triage (rule-based with LLM-assisted scoring) within minutes, then passed to a human analyst, typically within 24–72 hours. Pro and Enterprise reports skip automated screening entirely and go directly to a human analyst (24h SLA on Pro). You'll receive an email confirmation when you submit, and again when there's a meaningful status update (abuse confirmed, forwarded, resolved). Intermediate steps don't trigger emails.

Question 14

What happens after I submit a Free-tier report?

Accepted Answer

You receive a submission confirmation email immediately. Automated triage then evaluates your report within minutes — domain, evidence quality, description detail and behavioral coherence. Reports with sufficient evidence are accepted for human analyst review; clearly invalid submissions are rejected. You won't get a separate email for acceptance — the next one will be a real update like abuse confirmed, forwarded or resolved. Live status is always visible in your Dashboard.

Question 15

What happens after I submit a Pro/Enterprise report?

Accepted Answer

Reports submitted via the Company Dashboard bypass automated screening entirely and go straight to a human analyst. Pro carries a 24h SLA; Enterprise can be customized. This direct human-only handling is a core benefit of the paid tiers.

Question 16

Why was my report rejected by automated screening?

Accepted Answer

Common reasons: too short or empty descriptions, no evidence (no screenshots, logs, hashes or links), reporting a well-known legitimate domain without strong evidence, gibberish or test content, or fabricated file hashes. To avoid rejection, write a detailed description (several sentences minimum), upload evidence, and provide specific URLs — not just the domain homepage.

Question 17

Who do you forward reports to?

Accepted Answer

Depending on the case, we may forward to hosting providers (to suspend hosting), domain registrars (to suspend domains), law enforcement (for criminal activity), or other relevant organizations.

Question 18

Can you guarantee a website will be taken down?

Accepted Answer

No. While we work diligently to pursue takedowns, the final decision rests with hosting providers, registrars, and law enforcement. Success rates vary based on jurisdiction and cooperation.

Question 19

What does each status mean?

Accepted Answer

Visit our How It Works page for a complete guide to all report statuses and what they mean for your submission.

Question 20

Is my information kept private?

Accepted Answer

Yes. Your email is only visible to our team and is never shared with reported parties. If you enable community sharing, only anonymized report data is shown.

Question 21

What data do you collect?

Accepted Answer

We collect your email, report details, and any evidence you upload. See our Privacy Policy for complete details.

Question 22

Can the website owner see who reported them?

Accepted Answer

No. Your identity is never disclosed to the reported parties. Reports are forwarded without your personal information.

Question 23

How long do you keep my data?

Accepted Answer

Reports are retained for 3 years for legal and research purposes. You can request account deletion at any time through the Contact page.

Question 24

What is the Community page?

Accepted Answer

The Community page shows anonymized reports that users have opted to share publicly. All users can read and like community reports. Commenting and forum access require a Premium subscription or higher.

Question 25

How do I access the Forum?

Accepted Answer

Forum access and posting is available to Premium (€9/mo) subscribers and above. You can browse threads, create new discussions, and reply to other users.

Question 26

Should I enable 'Share with Community'?

Accepted Answer

Yes, we encourage it! Sharing helps warn others about active threats. Only anonymized data is shown — your email and identity remain private.

Question 27

Can I see other people's reports?

Accepted Answer

Yes! All users can browse community-shared reports on the Community page. These show domain, status, and observed behaviors — but never reporter information.

Question 28

What is the Pro plan?

Accepted Answer

Pro (€249/mo, up to 10 seats) is Blackwall's B2B tier for SMEs. It includes a 20-domain watchlist, Managed Takedowns with auto-follow-up, Evidence Vault & forensic snapshots, brand protection radar, 24h SLA, Hoster Response Scorecard, NIS2/GDPR compliance export, SIEM integration (CSV/CEF/JSON), Slack & Webhook alerts, full automation API, automated triage (rule-based + LLM-assisted), OSINT/Zodiac access, 2FA and a dedicated support channel. All Pro reports are reviewed directly by human analysts.

Question 29

What about Enterprise?

Accepted Answer

Enterprise is custom pricing with unlimited seats and domains, SSO, custom SLA, dedicated account manager, custom integrations & API, legal-grade evidence archiving, on-premise option and onboarding with demo data. Book a call via /demo.

Question 30

Are paid-tier reports reviewed by humans?

Accepted Answer

Yes — 100% human. Reports submitted via the Company Dashboard on Pro and Enterprise bypass automated screening entirely and go straight to a human analyst.

Question 31

How do I manage my team?

Accepted Answer

Pro/Enterprise admins invite team members via invite links, assign roles and manage permissions from the Company Dashboard.

Question 32

Do I need to enter a username during checkout?

Accepted Answer

No. Since you're already logged in, we use your existing account. You only need to optionally provide your Discord username if you want automatic Discord role assignment. Your plan is activated immediately after payment regardless.

Question 33

What if I get an error during plan activation?

Accepted Answer

If you encounter any errors while activating your plan, please fill out our contact form. Our team will manually activate your plan and assign your Discord role as soon as possible.

Question 34

What is Automated Triage?

Accepted Answer

Automated Triage applies to Free-tier reports only. It combines deterministic rules with LLM-assisted scoring to review incoming reports within minutes — checking domain reputation, description quality, evidence and coherence. Reports meeting the threshold are accepted for human review; clearly spam/empty/fabricated submissions are rejected with a written reason. Pro/Enterprise reports skip this stage entirely.

Question 35

How does the system decide to accept or reject my report?

Accepted Answer

Multi-factor scoring: (1) description quality, (2) evidence provided, (3) coherence of selected behaviors with the abuse type, (4) target domain — known-legitimate brands require significantly more proof, (5) technical indicators (e.g. hash plausibility). Below threshold = rejected. Above threshold = forwarded to human review.

Question 36

What is the minimum quality for a Free-tier report to be accepted?

Accepted Answer

At least 2–3 detailed sentences explaining what you observed and why the site is malicious, at least one piece of evidence (screenshot, log file, hash or link), relevant behaviors from the checklist, and specific URLs (not just the domain).

Question 37

How accurate is automated triage?

Accepted Answer

Strict but fair. Under uncertainty it defaults to accepting for human review. Only clearly spam, empty or fabricated reports are rejected. Every decision is logged with full reasoning for admin audit.

Question 38

Does any automation make final takedown decisions?

Accepted Answer

No. Automation only handles initial screening of Free-tier reports. All investigations, forwarding decisions and takedown actions are made by human analysts.

Question 39

What is the OSINT Graph (Zodiac)?

Accepted Answer

Zodiac is Blackwall's collaborative OSINT investigation workspace. You map relationships between people, domains, IPs, organizations, crypto wallets and more on a live graph canvas, enrich entities automatically, work in real-time with teammates, and — once the case is solid — submit the board to be verified and flagged system-wide so every analyst on Blackwall is warned about the same infrastructure.

Question 40

Who has access to the OSINT Graph?

Accepted Answer

Zodiac is available to Pro and Enterprise subscribers via the Company Dashboard, and to Blackwall team members (admins/analysts). Admins can also open it from their profile page. Free users do not have board access.

Question 41

How do I use the OSINT Graph?

Accepted Answer

Open /osint from your Company Dashboard, create a new board, then drag entities from the left palette onto the canvas. Connect them with the Link Tool, set evidence levels, add notes and sources, and use Smart Paste to auto-detect entities from clipboard text. The board auto-saves, snaps to a 20px grid, and supports both dark and light mode via Board Settings.

Question 42

What entity types are supported?

Accepted Answer

30+ built-in entity types across Persons, Digital Identities (email, phone, usernames, social accounts), Technical Objects (IP, domain, server, hash), Data & Artifacts (posts, documents, leaks, passwords), Locations, Organizations, Finance & Crypto (wallets, transactions, tokens), and Threats (malware, vulnerability). You can also define fully custom entity types with your own emoji, color and properties.

Question 43

How does real-time collaboration work?

Accepted Answer

Boards sync live across every connected analyst. You see teammate avatars (presence), live cursors, and a soft lock when someone else is editing a node (60-second heartbeat). The host can invite collaborators by email and switch each member between read-only and edit roles at any time.

Question 44

What enrichments does Zodiac run automatically?

Accepted Answer

Right-click an entity to enrich it: IP/ASN lookup, WHOIS, crypto wallet inspection, plus external intel from VirusTotal and AbuseIPDB. Results are written back into the node's attributes, with the source recorded for chain-of-custody. No external API keys are required from you — Blackwall handles the integrations.

Question 45

What does 'submit for verification' do?

Accepted Answer

Only the board host can submit. A Blackwall verification officer reviews every entity, relationship, evidence level and source on the board against strict criteria, then either approves the board (the identified infrastructure is added to the global threat database) or rejects it with written reasoning. You receive an email with the decision. Confidence scores are admin-only — they are never shown to users.

Question 46

How strict is verification — and how do you prevent invented facts?

Accepted Answer

Very strict. The officer is constrained to only use information present on the board: every flagged value must appear verbatim in an entity, and every sentence of the reasoning must be traceable to a specific node or relationship. No external assumptions, no invented stats, no embellishment. Boards with a single entity, only vague suspicion, personal disputes, or unverified public-brand accusations are rejected.

Question 47

What is the global flag database?

Accepted Answer

Once verified, the infrastructure indicators (wallets, domains, handles, emails, IPs, etc.) are written into a global threat database. Any board on Blackwall that contains a matching value instantly shows a red 'Ampel' pulse on that node — across every workspace, in real-time. You can click any flagged node to see the original case (sanitized public graph, reason, indicators, linked entities) without ever exposing the original reporter's identity.

Question 48

Can I mute or acknowledge a flag?

Accepted Answer

Yes. Inside the node details you can acknowledge a flag, which replaces the red Ampel with a small Ghost Icon. The global flag itself stays in the database — you've just told your board you're aware of it.

Question 49

What is One-Click-Import?

Accepted Answer

When a node matches a known case, you can import the case's connected entities (alt accounts, related wallets, infrastructure) directly into your board as read-only Ghost Nodes with their relationships pre-wired. This lets you instantly expand the web around a confirmed bad actor.

Question 50

What is the Zodiac Navigator?

Accepted Answer

A pathfinding tool: pick any two entities and Navigator highlights the shortest chain of relationships between them across the board. Useful for showing 'how is this wallet linked to that Telegram alias' in two clicks.

Question 51

What is the Adversarial Persona Profiler?

Accepted Answer

An on-demand analysis that summarizes the behavioral pattern of the subject(s) on the current board — likely modus operandi, recurring infrastructure choices, language/region signals — strictly based on the entities you've gathered. No invented background.

Question 52

What about board history and audit?

Accepted Answer

Every board has versioned snapshots you can roll back to. Every verification decision is written into an append-only audit trail with SHA-256 hash chaining — admins can verify the entire history end-to-end and export it. Realtime edits, locks, comments and provenance changes are all recorded.

Question 53

Can I comment, assign tasks and pin findings?

Accepted Answer

Yes. Each node supports threaded comments, task assignment to specific collaborators, provenance + trust level tracking, and a virtual pin-wall for key findings. A timeline view lets you replay how the investigation evolved.

Question 54

Can I export a board as a PDF report?

Accepted Answer

Yes — Pro and above. The export includes a graph screenshot, an executive summary, all entities, evidence levels, sources, the chain-of-custody audit hash, and is suitable for handover to legal, partners or law enforcement.

Question 55

Is there a mobile viewer?

Accepted Answer

Yes. Each board has a read-only mobile route (/osint/m/:projectId) where you can view the graph, read comments, post comments and update status on the go — no editing.

Question 56

What is the cross-board pattern scan?

Accepted Answer

A background job runs every few hours and looks for entities that appear across multiple boards (e.g. the same wallet showing up in three independent investigations). Matches are written to a findings table so analysts can quickly spot shared infrastructure across cases.

Question 57

What file formats can I upload?

Accepted Answer

Screenshots (PNG, JPG, GIF) and log files (TXT, LOG, JSON, XML). Do NOT upload actual malware samples — they will be rejected.

Question 58

Is there an API?

Accepted Answer

Read-only API access is available on Startup, full automation API on Business, and custom integrations on Enterprise. Contact us for API documentation.

Question 59

Can I add evidence to a report after submission?

Accepted Answer

Yes! Any logged-in user can add additional evidence to community-shared reports using the 'Add to Report' button. You can upload screenshots, log files, and must provide a written description of what you're adding. Our team is automatically notified when new evidence is submitted.

Question 60

What is the Domain Watchlist?

Accepted Answer

The watchlist lets you monitor domains for typosquatting, blacklist status, and SSL certificate health. Premium users get 1 domain, Startup gets 5, Business gets 20, and Enterprise gets unlimited.

Question 61

What is the Evidence Vault?

Accepted Answer

The Evidence Vault captures and preserves forensic snapshots of suspicious domains — including full HTML DOM, screenshots, and SHA-256 hashes — for legal and compliance purposes. Available on Startup and above.

Frequently Asked Questions

General

Submitting Reports

Report Processing & Automated Screening

Privacy & Security

Community & Forum

Pro & Enterprise

Automation & Intelligence

OSINT Graph (Zodiac)

Technical

Cookie Notice