{"report_id":"0ff41fcd-452f-48d9-9d2e-b5962f64e402","version":6,"status":"done","tags":[],"date":"2026-02-14T16:52:54Z","url":{"schema":"http","addr":"crostw.net","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":0,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"final":{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"title":"Crostw","dom":{"size":94374,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (52129)","md5":"6dff02d6ec04785cf8f85aae42db09ed","sha1":"9ca0588343f47e0f42d9337d327315bb235d3e24","sha256":"91786fd108e70e0c3ebb0ba773a95e139e61691e74fa4e4fbef7117355a74a80","sha512":"0384e323de435f55af9607f76c5653b966b5f0fb9696914d1ad805156a2c36dddcb6a3143f286f1d87ba2665159dc5d08de3d8ecedc677ce2e5d3199759ff96f","ssdeep":"1536:5BxAU+wxFaPSXFDIiF7mcx6wkZZIRZuh7Bbb1zdo7X6GoWeO4i8OwJNaG3wti:5BWRIEtbooWeO4i8OwJNati","tlshash":"a3930ab4e7a8047c580b43dad62265a4335e9caff5138814babf4e609b43d8cdb178dd","dom_hash":"domhash59e8d348848178716cf005afc72a7557","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"crostw.net","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":0,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-21T16:52:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"crostw.net","ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"domain_registered":"2026-02-03","domain_rank":0,"first_seen":"2026-02-14T16:51:23.419948Z","last_seen":"2026-02-14T16:51:23.419948Z","alert_count":82,"request_count":82,"received_data":1002449,"sent_data":51182,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"ThinkPHP","description":"ThinkPHP is an open-source PHP framework with MVC structure developed and maintained by Shanghai Topthink Company.","website":"https://www.thinkphp.cn","common_platform_enumeration":"cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*","icon":"ThinkPHP.png","categories":["Web frameworks"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"47c3204a8227b294435d98ef5a9b67b8","sha1":"0808f51edb1d2cf9086ee1000f5703fdc259ab45","sha256":"e9ca8c95f5f512864ffd7bf040c421e849d23cb5d2774bdfd7095a8e8469afc7","sha512":"83d589ead5d8133688c01bf15d59a2d2c2203e1bb85efc28bf16375a96f4af87146d517496b43db340fe92ab5cdf87ce0b473131c443b9f143f0a209839e40d1","ssdeep":"","tlshash":"c5414150f3681376317700be8f0f7ad0e72d4097a272c659bd6e859c3310864a7b3ad6","size":2014,"data":"","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-04-15T04:10:31.938501Z","times_seen":113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"3e577209523b87c396f9b7c49bb3aa8f","sha1":"91fed3971e31fc2a4c0610505cce91cff5ecbd6c","sha256":"fd53742656c1e6eef2f24802d0e4e85e3bedc4db1ea64eca9cec819926c76b5e","sha512":"5abefba2d170ee5fdc8d2962d531415aaf46abd4139349bf7bb25e6c74c5a7c6d6a24941b5d4f37869d25b8cdc8893669137d6744d3a77c2069f73e4c9ede080","ssdeep":"","tlshash":"1bf0b498f992293c74a324258f6f016078a93107ca44dc183aec78c65f4850cad7af9e","size":639,"data":"","first_seen":"2026-02-14T16:51:28.942598Z","last_seen":"2026-02-14T16:52:57.46505Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"be1372edc59594bd508e72a3e5f870a3","sha1":"57b7b6c036b60a457900ba80cb23c1a00b215861","sha256":"6f83c34e3edecc37bf357dbe0fe523af6cd9ff0e71d949d2c7e2b9adadbf4738","sha512":"6e60e70e8198702826ad8b5d5730d4b9405eadd105f91f65b7e7ebc475e16d4b2f71084a33e726a32678e67c928e795cbc1d074cf5fae35d69aef10c8c7e0ca3","ssdeep":"","tlshash":"d2110080c020cc00808000382cc2000220300000c00288300c008080000c823c0a8808","size":967,"data":"","first_seen":"2026-02-14T16:51:28.974246Z","last_seen":"2026-02-14T16:52:57.46776Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/bendi/js/jquery.min.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"d021c983bd6e7291b43a5cc1fb2ebe99","sha1":"ffe47a16e4b1550ddfba3577cc9cc9fdc8643aff","sha256":"c0d4098bc8b34c6f87a3d7723988ae81214a53a0bb4a1d4d36a67640f98ed079","sha512":"0b01d408ae79a4e3630f1bcf6507aec0aa71a2cf263f212ff601ae582f15af4df9ec9dae5e0d4fc9c1833cd0fd1207689121531ba920480a680e3f4e336da4b3","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa9G:7NMnJiz6oAQKP5a98HrB","tlshash":"5983d6d9b6c27062977734b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84280,"data":"","first_seen":"2023-03-07T12:01:55Z","last_seen":"2026-07-24T03:36:26.08517Z","times_seen":10248,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"7b21ffa39791af52a5d7e590d6803367","sha1":"a498e2929a2de01a65525501e77d1b993a044bb9","sha256":"d2e8463e395a69a84180a474d77f9b48f85519bda6c401bef5894c3503a52f04","sha512":"95ad39482d5f6913eab3bb0f2f001036374bb054f12aea97ea5d0d1cd3ab543732f2375c6e7a0379c65b1dbb95ed27aee06aec81f48133a63833b88d921e626b","ssdeep":"","tlshash":"39f0a75db496682d74a724258f6f005034e57043c656e8253eec78c3df4850e6579fdd","size":563,"data":"","first_seen":"2026-02-14T16:51:28.946452Z","last_seen":"2026-02-14T16:52:57.472499Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"6e5e3fd67ef581790c131d79918cf8f2","sha1":"6d2c26104c4898e4cc3a34a71a0f627cd955e43b","sha256":"822df3006dd562f87dc0e0deb7bcfe7493db8eb4c0bab451f46acd9952a44fc2","sha512":"2ad76ecdd22149e2aaf776c0d229b1fe2d63ab80d972ca11a966a41212fdacaba616818803fc7c396a9983276f5b22e6ba8c9e722441aaa39ecdc476b23b8c15","ssdeep":"","tlshash":"7e1100c0c0003c00c0c3003c0cf00000f0300000c030c0000c0cc0cc00ccc33c000c0c","size":980,"data":"","first_seen":"2026-02-14T16:51:28.981073Z","last_seen":"2026-02-14T16:52:57.473539Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"06d386619a5404f3c3636ff75836e2f5","sha1":"2fd232fd63ba37e4e64421ca7b80197f6f3e6a1a","sha256":"e2e557ee772720f020fa5e83777ef4e6eace9613e6b5921ae4f335d9cbf87417","sha512":"24c7104dce88591bc15045290fcce54eb255294b1688a438cc3902113cf990e9890edeb165b3a57c706469cdf5cb1b08a7c1cdc3a50be1628b1eeb6440fd5d5f","ssdeep":"","tlshash":"64f0a06cf496642cb49338258a6f005034e67443ca49d8243eecb8c29f88519a9bafde","size":563,"data":"","first_seen":"2026-02-14T16:51:28.949667Z","last_seen":"2026-02-14T16:52:57.474606Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"e02c4a98e78d7223517d687805cfb6f4","sha1":"7bfc11ee2d5214bbe86ea27582ada2913390b2c0","sha256":"c47c364321f84c7f165d34caf68d0e946b64d92982c26b22c7e22d79acba25dc","sha512":"0e139de1608d0d373af101cd2f64578dafe70e5bfa56fb090f384d3b5567a04a294954e60a55b6589e9f018f69ec46caaedc97d2fba13c8dc0baef3de1190f9d","ssdeep":"","tlshash":"88f0a75cb4a6a86c749328358e6f045138f53083c645d8243eec68c25f4c90eb5b9fdd","size":569,"data":"","first_seen":"2026-02-14T16:51:28.951686Z","last_seen":"2026-02-14T16:52:57.475632Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"04bd55eb0cc0afaa81e1ee0bb1bc2299","sha1":"ae1d0a85bacf861ea524456b6ada657ef3780a6d","sha256":"61b890c278cd0bdc4dc01e285bb94a3839ecdd66848debafbfaee9f6c453faa0","sha512":"d9a00acc7667baebbbd63ddfc189d970816ea1b04cd1e064c6bf73395ded422041b5dbfc3b7c8b6769c2ccef4007dba0bc36658a9c5786c908254f8d7d707135","ssdeep":"","tlshash":"d6f0a799f497282c749324258aaf006034a53183c655e8167bec6cc36f58509aab9fdf","size":563,"data":"","first_seen":"2026-02-14T16:51:28.954576Z","last_seen":"2026-02-14T16:52:57.476703Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"1110f63a83142e2d85d176c0c02f506e","sha1":"cc085f4733546c3d11c690fe5405d7f6c887d808","sha256":"6416458efc04ca300ba17143f31683aec099682e984dcf79cb1d9832f59c09f7","sha512":"f1bd67668d47e3d4f056c9750e048124874e22093ace41704f9574c4982f9fc0b4b86243e24da40dcd615e17c533628ed8bbe3d7c1efe4edc6e80412bb3d9c98","ssdeep":"","tlshash":"6ff0a758f596252c78a364258b6f0050b4b97143c645d8283efc68c69f4850d6579fdd","size":563,"data":"","first_seen":"2026-02-14T16:51:28.956659Z","last_seen":"2026-02-14T16:52:57.477718Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"ed0e989add32409a8b71816663e79e29","sha1":"10b01c905920cfed7411660b14318d48b9d7ce37","sha256":"3c8e8b4f288fc053f5be8b37e56a2fc33cd9d4e2c6c30d127d1c7e1ef1be46fc","sha512":"90a67afb106e680d8ef4117afea160e7f29f74b7723cbeabb6e9481b710ed62af874a21671769bf823a4b8ade48faa3121b9be41c5edf42a8a3852139273b748","ssdeep":"","tlshash":"6b1100e0c08e0c22808080380cb0000220208000c8c08000080080800008002800080c","size":976,"data":"","first_seen":"2026-02-14T16:51:28.937616Z","last_seen":"2026-02-14T16:52:57.478716Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"42123dcad90eb3c3b1f3341299b02df9","sha1":"b8fe93da3e8355503ab19a9fcd789c4d129eb590","sha256":"7dfa718cbe8e2fc6b9761ded5a236cd857c4db1e4fda471bf3c4fc02429dc4f4","sha512":"af4125aa8b676f5fad10add5a764f72af8b50622cc865e3429af70a1fbb463903fb3fd7212d8fe32cfc864a825b455774a0e6d22f1354f5449aa622c3d649122","ssdeep":"","tlshash":"aaf0a758b496243c74a334258baf005034a53247c645d8143efc68c25f4c51d65bafed","size":569,"data":"","first_seen":"2026-02-14T16:51:28.958634Z","last_seen":"2026-02-14T16:52:57.479753Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"4455de413be9eb2e663b8e9a3b92ca41","sha1":"9dfe0d0ab26a207a76ab4515104efdf3cc11c9bd","sha256":"327b1cf24175eb8f341ffbbcea5e8cab46d39b6210312227791db162fd20b98c","sha512":"a1121873e9279659ac70e45c4280d04bc8260d27c0b207b2ea5c9949ef2da1ed7202d812f194fb2168e631ef85eabe1aa531e1e92ff7e3db1c3f5bc16b281e00","ssdeep":"","tlshash":"e1f0a758b4d7283d74d328258a7f005934b57043ce85d9543afdb8c29f4850d657afde","size":563,"data":"","first_seen":"2026-02-14T16:51:28.961235Z","last_seen":"2026-02-14T16:52:57.480861Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10588e768f69d0c04730506d6a90ee12","sha1":"43d11e8436bf0c125248d02921cdbcaad7ed61d7","sha256":"fd6e69ecb531af4644a8a75fd2518972af0d9ef8082a3425a6c9dc76819b2ab5","sha512":"ae3b4da1d981ad8f5cb8092fa9a7fe3965631f43c0a480eae00f139e0412626862e0b900314da2d7394413932fba86083907a92d38de823138449e494d30e4c3","ssdeep":"","tlshash":"e9110080c8000c00808000b82c82003020202020c00080000800808022080028a0080a","size":968,"data":"","first_seen":"2026-02-14T16:51:28.933904Z","last_seen":"2026-02-14T16:52:57.482031Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/js/layer/layer.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"666f4437565d197e9459e19a29f58315","sha1":"afc5c0a1369137e52b37ad5fb63f48202ce31368","sha256":"4a49651ad86a83ecbd9c2ad34e7f5c906b46ae2c4c93c1c8585148f936b7e100","sha512":"1e659ff6c47458dbbaf7e7561402c12441286c255ddec048bf654388e8666a9ceca344e166657c29fce4a08b46470b44c47e8f1c6f577adc2a4e4f4f0e7e1e90","ssdeep":"384:DQ8cuj0z4VfS7ShA3BMJOoM6bs7hwI9b4Zrxy:DQtu8CfS793QODbcI","tlshash":"5f92c85ab5503593216390a9911fa90f30f24d22eb078958f16bf1fd1ebcda562b3f0b","size":19831,"data":"","first_seen":"2023-04-11T09:52:52Z","last_seen":"2026-07-24T13:58:42.996856Z","times_seen":14045,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"31d5d342156b895867ea293bfe5cb77d","sha1":"82d0697d7f0ca975853f79573147364a9513a444","sha256":"a6fd1f985d55f033fd2c19669f6ba32d2e42969567f9c66212d5afbfc1077d47","sha512":"91a16daf4cb7ae9f06d524352b462c4605d45c0f924137514d152484c3979b313d4915f04d2cd51f0eeb4620d4bd04a64ee6dffd242b10a8ceca08889330cd11","ssdeep":"","tlshash":"42f0a75cf496252c74d324298a7f0050b4a53443ca55d8193afc68c29f8891d6579fde","size":569,"data":"","first_seen":"2026-02-14T16:51:28.96329Z","last_seen":"2026-02-14T16:52:57.483797Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"92c120048d305c32706f4094b83ede76","sha1":"5e3f72cb4bd3c3a58fafbfb4039f7428522a76c3","sha256":"701f7502c2e95b25983b6c7c7d8c5a3934c8bc5576976680f0a55caffc9be38a","sha512":"1c8fb54aaf7c5091df2686cc8fcbb181777ebf272146af1a1926de6984bcc54550be7a077cdb93718dbaf919cb052aaea6475a9566c11f3ba9909352d34ead5e","ssdeep":"","tlshash":"4e110082c000082880a000380c82000020200000c00280200c0880e000280228002c08","size":974,"data":"","first_seen":"2026-02-14T16:51:28.979243Z","last_seen":"2026-02-14T16:52:57.485178Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"e69f11618b9158f206f195909f3702f1","sha1":"c6c03ac92ba2577d18249e67da73b7fe05e800c4","sha256":"09ac476f2cc2fbf544db72e54da32fdaa4679e07d5be8cbdde003cd7f2bbe8d6","sha512":"38fec76aaa4a3e1e98cbcac946f26a9ab6ce22c188826059c5b451f8a394019f3172212472a7bd300544582597c68bc30e7cfaef57a3962afe8605dd323ee2f0","ssdeep":"","tlshash":"a01100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":962,"data":"","first_seen":"2026-02-14T16:51:28.932116Z","last_seen":"2026-02-14T16:52:57.4691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/iconfont.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc853281f74275a23f48d5159bc04f48","sha1":"5065a6d8fef4c81d4f50a5aa20095c62733e623e","sha256":"a586f420effbe849c9026d8ab400f5f900826b5a1a01e091467b57224e897eb7","sha512":"f52c4b234e0ff8215f06491fc34ef3ec86ebf85baf8964ce6e76f5dc0d9507500cb83f2622fa0c3cbbf410b15f8760b10ca6a63e1a386d0c901675f74b7ff2c3","ssdeep":"1536:aAYIIXla1ajFDIiF7ma19kwCZZkNZuxhL7mk:XK+k4Nqk","tlshash":"a833b9f8976855fc9c0ec3ed9626a568230f9cfe79624928895e8f5097037dccb0788d","size":53374,"data":"","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-14T22:00:52.326736Z","times_seen":241,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"05e860818cb77e3cd70c433c71b0d93e","sha1":"f6f0e4dd30903e80303dc00f2065b850bcf896c2","sha256":"00021bd89eb0789704e1e0b045969844f9ffa70291fc7641f6affc55f325976d","sha512":"592c643b4b4c5ae5a3300c9ea6606a99198751c04e62fcfb35a7dbefe472868a9df9ded1f3a30fababb727c6e32828861cbb67ef0b0d7f8aa9873e2a9ec6bcca","ssdeep":"","tlshash":"3bf0a058f496283c749328258a6f005238e57143ca45e8143afda8c2af98509a9b9fde","size":563,"data":"","first_seen":"2026-02-14T16:51:28.967423Z","last_seen":"2026-02-14T16:52:57.486544Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"579a9df92234dc05ef1befb3ee206022","sha1":"1937d199bba5d917d5c8e0b76febaa3645efecdd","sha256":"39fa6dab78b68f647893e87eb4a1040af96eefb284f5c65d26fd891040a02f8f","sha512":"8e7c09b2d36105364768da513ca607ef4e314550d3910761e9bfc62fbf949fafec9ad1886f8f60503ed2947e2adab48bd9fe339c549f97ed0ca3930dde780a39","ssdeep":"","tlshash":"f0f08c5cb597253c789328258baf005034a93143ca45d8183aeea8caaf4850dadb9f9e","size":563,"data":"","first_seen":"2026-02-14T16:51:28.96942Z","last_seen":"2026-02-14T16:52:57.488046Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"9b033ffa719ebb3ce18bee3bafc8174b","sha1":"8c1aa937a3252e69bf0a2f5b579f72eb4bd46dbc","sha256":"1f98e078029e14c65251a553371ffbe9b6edcb25ada56a0a68099ad57d035eb9","sha512":"daad00e865015b75122126812a3af1088e969345fdb9f909b32019e4ead761187bff4ab3bc9d3af1dca2aadab14d80c6fb1b8db661c32fb26115b0f68ee86c50","ssdeep":"","tlshash":"6ff0e56cf497253c789328258a6f005138f93047ca45d81c3bfca8c2af5850da9b9fde","size":557,"data":"","first_seen":"2026-02-14T16:51:28.972116Z","last_seen":"2026-02-14T16:52:57.48929Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10588e768f69d0c04730506d6a90ee12","sha1":"43d11e8436bf0c125248d02921cdbcaad7ed61d7","sha256":"fd6e69ecb531af4644a8a75fd2518972af0d9ef8082a3425a6c9dc76819b2ab5","sha512":"ae3b4da1d981ad8f5cb8092fa9a7fe3965631f43c0a480eae00f139e0412626862e0b900314da2d7394413932fba86083907a92d38de823138449e494d30e4c3","ssdeep":"","tlshash":"e9110080c8000c00808000b82c82003020202020c00080000800808022080028a0080a","size":968,"data":"","first_seen":"2026-02-14T16:51:28.933904Z","last_seen":"2026-02-14T16:52:57.482031Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"879d5b582ddd7e9813c8c143367392a0","sha1":"4eff938ec35895bb806458a5d6b2aca309c740c9","sha256":"e28600c18330d80f6480ca6e53a0479ce968f58b1c52b33cd239f6af7b9e63d0","sha512":"0707d2e76615eb51f0e329a3351014bc5def36062f6c838c968784554102d1980dc1abf867a9703f9357884d7dab3a13b6d92461ef4429673bce3ce949322723","ssdeep":"","tlshash":"bdf05c68f4a7253c789324258a6f041034f83043c649d8143bfc78c29f4850c6579fdd","size":560,"data":"","first_seen":"2026-02-14T16:51:28.976248Z","last_seen":"2026-02-14T16:52:57.490574Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"7d3d70779778eb5f6033d0998ee69131","sha1":"e51c897adf5f4e60b1fea59620acfebbe583fe75","sha256":"9487f7ce0d4ae294cdcbd2c442655cfc3c2c3c6ecc94b323a7e9a41db9331d1c","sha512":"63ba0f604529fc97fa522cf94858c0eaec79bea71241dd76f98b09dacf4a24fe1d0d4009ef24ad2d45a05dba762052bb4828aa74332e8847f6fc15c237a1d8ca","ssdeep":"","tlshash":"bf110000f2000028c08802f0a38220008288002ac2380000a00028880002aa80080222","size":1094,"data":"","first_seen":"2026-02-14T16:51:28.939461Z","last_seen":"2026-02-14T16:52:57.466317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"cf39146eac1dc2e89cb94e62c405dac5","sha1":"72897df29de4c0a39d06a6403404e4470ce082d4","sha256":"ac172a7e3d948d6c2646b017bec71d01fea6701265c2523568a002c84a3e0401","sha512":"c692cfe64b8e5b0dc4952e5a1d39dbe6c1dbe4ce93c7c048b5adaff01e603eefc85771c766cd974773f762350968ddeec0350089bba9c1e3e4817b5aeddb0efc","ssdeep":"","tlshash":"bb1100f0c0000c00c0c0303c0cc0cc0030330c00c000c0300c00f0c0000c033c00cc0c","size":964,"data":"","first_seen":"2026-02-14T16:51:28.965341Z","last_seen":"2026-02-14T16:52:57.492091Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"abbcd6bd1cde4fd20ccb3cf58c9fb103","sha1":"0bcec1b3f0c932d3a8f10b8ceb19a3a4f29c171a","sha256":"b134e6d3514f1e749359a32ed8ce58606033908f0996b9c21d38e9d0af4a7c82","sha512":"75355f98c43ad6d7797d8d3f89f466ebf2fd3dc57c549930b6bcc0f6e3b0e03bb59278fff795ddcdfb33d8488d010a03f9614863e202266b67308fd90b757143","ssdeep":"","tlshash":"d2314801e30b6cd828b29a2e1f5789561c3914232843cb687f1dd7f0afe5d876868dec","size":1874,"data":"","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-02-14T16:52:57.493494Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"cab954d62e86c4ae24550630ef96fc28","sha1":"011e558f4de599a8053c3143ddd33561c389edea","sha256":"6bd68dc7178c6a77632e3f848998c6b76a0d25c290c71f436b43dbc160dddd14","sha512":"89b599ed8bee08b22e277d9b5f7936914c4e7c58cd8bbf3c4d15c3542af3decc8db648915e85bf29c8efca1dcce051c756eb5ce507c9024b843d6a8ffb9e66c8","ssdeep":"","tlshash":"cc1100c0c0003c00c0c000fc0cc00000f0300000c0c0c0300c03c0c0c00c003c03cc0c","size":970,"data":"","first_seen":"2026-02-14T16:51:28.944375Z","last_seen":"2026-02-14T16:52:57.494395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"be1372edc59594bd508e72a3e5f870a3","sha1":"57b7b6c036b60a457900ba80cb23c1a00b215861","sha256":"6f83c34e3edecc37bf357dbe0fe523af6cd9ff0e71d949d2c7e2b9adadbf4738","sha512":"6e60e70e8198702826ad8b5d5730d4b9405eadd105f91f65b7e7ebc475e16d4b2f71084a33e726a32678e67c928e795cbc1d074cf5fae35d69aef10c8c7e0ca3","ssdeep":"","tlshash":"d2110080c020cc00808000382cc2000220300000c00288300c008080000c823c0a8808","size":967,"data":"","first_seen":"2026-02-14T16:51:28.974246Z","last_seen":"2026-02-14T16:52:57.46776Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"a459cc8498423facedfcdf9e1b13077d","sha1":"5ef3f588c027251900e97546af054791b73a8675","sha256":"bbe2153d596ea6fc3526cd1fff8e8fb337300e56cd5676e9830222bd571392ef","sha512":"2efc2095c6e0714004713a92bf99bf945ba572639796d1468c12fd9bac65cc26bba96d64c6ea1807a2ed3b9071b41fe8bcf1dfc7e2cb6f215eaac8f89fe799f5","ssdeep":"","tlshash":"bd01a44cf0269d2845fb3a1d4acf85929cb4315b88256c017bacacd5af8c55d7607a1a","size":709,"data":"","first_seen":"2026-02-14T16:51:28.982959Z","last_seen":"2026-02-14T16:52:57.495777Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"cf39146eac1dc2e89cb94e62c405dac5","sha1":"72897df29de4c0a39d06a6403404e4470ce082d4","sha256":"ac172a7e3d948d6c2646b017bec71d01fea6701265c2523568a002c84a3e0401","sha512":"c692cfe64b8e5b0dc4952e5a1d39dbe6c1dbe4ce93c7c048b5adaff01e603eefc85771c766cd974773f762350968ddeec0350089bba9c1e3e4817b5aeddb0efc","ssdeep":"","tlshash":"bb1100f0c0000c00c0c0303c0cc0cc0030330c00c000c0300c00f0c0000c033c00cc0c","size":964,"data":"","first_seen":"2026-02-14T16:51:28.965341Z","last_seen":"2026-02-14T16:52:57.492091Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"cf39146eac1dc2e89cb94e62c405dac5","sha1":"72897df29de4c0a39d06a6403404e4470ce082d4","sha256":"ac172a7e3d948d6c2646b017bec71d01fea6701265c2523568a002c84a3e0401","sha512":"c692cfe64b8e5b0dc4952e5a1d39dbe6c1dbe4ce93c7c048b5adaff01e603eefc85771c766cd974773f762350968ddeec0350089bba9c1e3e4817b5aeddb0efc","ssdeep":"","tlshash":"bb1100f0c0000c00c0c0303c0cc0cc0030330c00c000c0300c00f0c0000c033c00cc0c","size":964,"data":"","first_seen":"2026-02-14T16:51:28.965341Z","last_seen":"2026-02-14T16:52:57.492091Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":true,"md5":"d538152877f12a0b94aca45c07cd0525","sha1":"ad4daffa8ff7e7e6676627d25ac14d5aa55dd589","sha256":"cc13feb74b127aac5e3fb9217de335a1791340e2a6c049e90ef45a5a2cf85346","sha512":"13241775040b30b3f035afc44d1c9146ca1094ae3ee0fc160aed86ccc7d90846dfebbb375517b25fd726dadcd81793822b9f0f8bcee5b047e14af8772014e771","ssdeep":"","tlshash":"f6d02b64e79c0449e47332209e3f0dcda42d343b6903005b411c29acb8e766c1221d28","size":276,"data":"","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-03-20T12:19:24.368239Z","times_seen":70,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"10e5bd6ec08116d2761abd329d5b7d1b","sha1":"aee6ea940198491082881bc16b87852e6181a2a4","sha256":"43bfcf9fe4a3761939e66ddb50a6e82b7aed060f1c78610b9e27b9cd673f16ee","sha512":"2161d0a0b3a5f44173e4adef57adaa4015b172654dc78bd68f57ba064ca1f0058106cc17de8ced7e668a50b5bc7e03ff147e2e688d239f5bf8bc572c4a41262b","ssdeep":"","tlshash":"68110080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":960,"data":"","first_seen":"2026-02-14T16:51:28.930183Z","last_seen":"2026-02-14T16:52:57.470395Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"introduction_type":"domTimer","is_inline":false,"md5":"9ca9ddc9f123e7e393fdf02a747b0dfa","sha1":"4b903fb29c76a3d14cf3222d11c9ccf46faa7e6c","sha256":"da5292e00dd1d3fc2f09215370af3290ffd4e4a67030d6fd23aed09a322c1df9","sha512":"7ca0e62488eb6416621ecebc544cbc65c33522a7221af2446e79e1a05868f7da0896edb4429056275181548603cee265996e82a1b1602459944f7bc6d4389af8","ssdeep":"","tlshash":"9a110002c0000008000080bf80b00a00802883e0c8b000020808088000000002800823","size":997,"data":"","first_seen":"2026-02-14T16:51:28.935898Z","last_seen":"2026-02-14T16:52:57.471412Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:38.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:38 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2262d891d5afb571967fd5983d150a74","sha1":"bbdc7d9ae139fc995bdd1ee69556fa4d08c21f9d","sha256":"dccb80b011c9205d558ad11500aa105ecdcedcd83b1bdbdf738404bb5dd7056a","sha512":"86973b144f77f524f6856c89073dd35f68fced218e3c0ba6ea84849527b580cc768b2363133fe3aad44c0ba63d19126f51bf3c73a52ca512d0f17a55274df774","ssdeep":"","tlshash":"ddc08cb0b332502a0422cad242fa27de44890407c0c8838289ac8fac1a092242005050","first_seen":"2026-02-14T16:52:57.390535Z","last_seen":"2026-02-14T16:52:57.390535Z","times_seen":1,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:40.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:40 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_iota","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:47.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_iota HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=iota"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:47 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"622adde87dc5fe7095762754773751f9","sha1":"c104d100cc99af21c080374eaa42553df3bd6bef","sha256":"bc7e541937224a031de4952e3d93059920f0e60d8539a5dae0769a62030812bf","sha512":"5db1423799b053a5f1d4e0ad7807597de1b691da53212bbd6ae4a1f10054bc671493eb05fb596457da88e3338761d3376fcdc4922549715796d40bcf6f8610a0","ssdeep":"","tlshash":"2ec08cf0b330401300a182d302ea37ee24ec888ac08192824efddbb84a092207199464","first_seen":"2026-02-14T16:51:28.911498Z","last_seen":"2026-02-14T16:52:57.393984Z","times_seen":2,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:50.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:50 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d6dccaf829dfb27c102ad80e3c2ce74d","sha1":"356302b4b8b9e1ad983789c7fb7d5614dfafd967","sha256":"a30bb8cc30baa516a550c327c19645fd1db3e0deb4645e76db8b1d9117b6a19c","sha512":"7cfabb1e9bc39dc1903e3aa83db0503398b08d164acc8c7ecce629ac6115435c24b80001e516907300e7b6a430bc206f095d0564356bedf2cdca24fcf8f98a95","ssdeep":"","tlshash":"e4c08ce07332a2221066c6d242fa2bef08880906c488c34289bc8bbc1a092282004050","first_seen":"2026-02-14T16:52:57.395488Z","last_seen":"2026-02-14T16:52:57.395488Z","times_seen":1,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:46.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:47 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"110ee04f73efe99b605ad3ba7c4a2c6a","sha1":"3b93d7d42c4ddcd7308a48f6fb7e891a520233d9","sha256":"e642975fd8990270c2e8053a9a95b68753f08d576a2e0b85821d76aa3ab70b83","sha512":"a07f6e57c884d4dd4a63feb40125e3571172df8493e19ceb74214e680f14af3302b35ab45bf9f00c67efba6ac2fffe3ddc24813a3d19df9fe402bed1e1704cca","ssdeep":"","tlshash":"abe0c0e5b6bdc513247ac3d158c91b391cd60aa5c599d6060e7c1f6c0eac62c7217900","first_seen":"2026-02-14T16:52:57.397002Z","last_seen":"2026-02-14T16:52:57.397002Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:48.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:48 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"1a11b3ce7f863fb8a0a4d02021b94a8f","sha1":"b2c949789e3351a9d2f38d327880661e0cefc4e1","sha256":"2ae2c37e922d5a63b9a5e9eaaa7c65383e1b08821d527b08fd242841a7448152","sha512":"fddee103a1f8d5c283329033564d53c8ae77807add3e037341c00f8773d6e94642d1fc2cb12c2d70fb48c41e19b465552ebb622fc9a3c45bc1b07e23a426e310","ssdeep":"","tlshash":"d6c08cf07330401200a1d2e302ea37ee04ec948ac081824269fdcb281e49a247089860","first_seen":"2026-02-14T16:52:57.398482Z","last_seen":"2026-02-14T16:52:57.398482Z","times_seen":1,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_itc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_itc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=itc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:37 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"150d4a7de921663b20049e04d30f219d","sha1":"44dd5dba4fa1c13dd92c8dc672d3758ed75cf5ec","sha256":"a0ef14cc69341eccf8034b958151f5ab7692e95f87b2d4ef7a5bd05338617469","sha512":"394bb367dccf83a7e781890804a6a36f3535cbfb9f5d84cddc377f140a17c6aec1cdcb919ff8856531da5242de5ae27d3b912beabc7665e8687e8d562528b879","ssdeep":"","tlshash":"b980002022afa8a3028200288c0f000000ac38882ca080008c2822288a200228a00020","first_seen":"2026-01-25T21:02:29.649974Z","last_seen":"2026-02-14T16:52:57.400108Z","times_seen":3,"resource_available":false,"data":null}},"time_used":3047,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3047,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/bendi/css/bootstrap.min.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/bendi/css/bootstrap.min.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 23 Jun 2023 03:06:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64950c40-27293\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":160403,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65324)","md5":"3afe15e976734d9daac26310110c4594","sha1":"4f14a09a606c99a11f8fda15564ef66f70402826","sha256":"680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c","sha512":"aced925c428148809afc07f28442b966a58508ea24d6b7203d87c63aab57df93b28ab68183a5dae0d9c12705e0a484685de5a370099c42788c869db686d0dcea","ssdeep":"1536:2THqIJOT7SyEIA1pDEBi8yNcuSEeA1/uypq3SYiLENM6HN26H:YH9vGGq3SYiLENM6HN26H","tlshash":"03f353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf8273b6447892c70a73e4c","first_seen":"2023-04-05T04:00:44Z","last_seen":"2026-07-24T08:01:06.734633Z","times_seen":25652,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Mobile/images/iconltop.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Mobile/images/iconltop.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c32150-36b3\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14003,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 392 x 400, 8-bit/color RGBA, non-interlaced","md5":"27e5e064c1154404264d367649c59984","sha1":"0d9e766c8c08a54dfa77458bdbbac8b1c5f5fc8d","sha256":"6db94408baa30c3379c0b75b7d85d5670d65f4fdef849fd5809428df3f31d60b","sha512":"7433705c7a246b22c0069c3666587dc7a8337b0dc41e2a6e063c7f48db09c6560e871f8726d80bcb629c8955b75a002e24763e478a60ae132878fc5dedef8a30","ssdeep":"192:9lk5hW6f6Yo2bAMXVld75GJWBmp2meTfnKWPkgSjAAJZQm0jdftDFH:9lyhWc616zXrd7JdK+NGlQm0Zf5h","tlshash":"63529d18af24efead13787441bf7441280376175639893d2a822ec3a7e153c95e76bca","first_seen":"2023-09-18T04:47:42Z","last_seen":"2026-07-14T22:00:52.313452Z","times_seen":209,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/icon-3.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/icon-3.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-1864\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6244,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"6736f3ceb9a578a658a2268370b19659","sha1":"3e765604afbbbaef14e21a42869fa294295dbaeb","sha256":"87de36cdfe974eb67227ec9ab321147ec2876d0d710b23b70dccfc5b1bcf109d","sha512":"4286b8a9ade1afbb2ff43afee60a837beb3932710063280de118a3de07c32803f09fb4db34b705d36c7c68fdc7431a3e0bb09981b75667f818a4fffe6de2f31e","ssdeep":"192:JkkndLgkzSjGXadVpi1IQqsAGWInHWPKl3Y67yb/:Bn1FzSjGWnQCIn26IQW","tlshash":"4ad18e4cd551bd66a385a1bcdeec42abc722d74056c4e0099ce81d226c718f29e6deca","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.319242Z","times_seen":148,"resource_available":false,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:49.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Trade/tradelist","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-14T16:52:33.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Trade/tradelist HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\ncache-control: private\r\nx-powered-by: ThinkPHP\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"ThinkPHP","description":"ThinkPHP is an open-source PHP framework with MVC structure developed and maintained by Shanghai Topthink Company.","website":"https://www.thinkphp.cn","common_platform_enumeration":"cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*","icon":"ThinkPHP.png","categories":["Web frameworks"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42680,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1655)","md5":"22ddb486da9105df7096ed241045b5ea","sha1":"917ff77f2e4f7569a656ccb3f742ebe157060655","sha256":"9cd22504f8badbb06dfc16ace205ba04c2e0017038d83115f7a5b8587db2ea6a","sha512":"84192879a6f9d8f3e6cb2297b3b66c3c6f9112e3e4402253d57b2a16ef03d131744c0d87f7257df438dcd6a21571dada42d7fa1b2bb32731391fed15483573d6","ssdeep":"768:hPaTybb1zD5AmGX62TQx4+I5kxIh6JgtGZEpcTuDp/eNaUV3wth:hmybb1zFAbX6GKWeO4i8OwJNaG3wth","tlshash":"09139620e2e60c3e20631093d676679634aea913d657c454b7ff1ea06fc9c497837aec","first_seen":"2026-02-14T16:51:28.849719Z","last_seen":"2026-02-14T16:52:57.40542Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/icon-2.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/icon-2.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-fbf\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4031,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"c7b3960577f6e8239034c513a48ed2a6","sha1":"bae972c97f233165923f3890e4008bc5d7fac499","sha256":"5701645f155fad6c3e098f0f8d9b4a7b3ff73e91ee1027f99b30a63ebc3006bd","sha512":"c50d5133ef7dbeaf993e9a6cf5d146351e71803984b916d179dbe26f6197b48f893aaf6605f22f3b2b0a8b18ee700fa697d9072765d06f8394e592e805901022","ssdeep":"","tlshash":"35813c59fb849e050b0e9e402df883979f6347855ec09555fccbc867f8650d9ad2e8c3","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.298298Z","times_seen":170,"resource_available":false,"data":null}},"time_used":374,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/css/nologed.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.727Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/css/nologed.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 06 Dec 2022 16:48:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"638f7270-1140\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4416,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"32e791a69bdd27bdcb89c96b02ca96b4","sha1":"b47ed107260f41a25ba57b940246245e40f5751d","sha256":"0bdc47113249cd4e9bcb9189a8656813c91b18456dec41cec0e623e84c5b1ff9","sha512":"c3b28ced158d673e7cfb1479ad6770da730dbfd12c934c70e416f421c524275f4fb76622754fcccb3a9d443b708ddacc19b6540e35a6fc61933903fbdb863309","ssdeep":"96:wcqEYe8d1719LyqlkoXHySxNXtkTMXHyc:wcB8dJ19LyqlkoXHySrXtk4XHyc","tlshash":"b291f031eb5321017017c8947bfa9b98233cc017954badbcbbc276d58fc754da8a668a","first_seen":"2025-07-08T14:09:07.280217Z","last_seen":"2026-07-14T22:00:52.309843Z","times_seen":6,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Upload/public/62ac7f6a64120.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Upload/public/62ac7f6a64120.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-1804b\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98379,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 405 x 580, 8-bit/color RGBA, non-interlaced","md5":"b6a8a0f54b0dcae63eaf327388ef4577","sha1":"8d38a01ba096271c73266db0d7436b0dd9390ce7","sha256":"3f55aaf1c5d5f3ab1b1cc0548db42659361384e2ed8976d1d5c61a8ac1207f7d","sha512":"b02ded13cc5ced267025e5bd9ca9ead556526b8712ddcf0310404336271871ba83fcd7d4d5ef73e274441465741b153d491eb8e341d9f594e75ca7346d83ea08","ssdeep":"3072:3mk8d06ytXkFm7haZkdr9Nbz/Vp9u9FoC++ghfY+eS9s:3mRfyhkFm7haZ4rHvdp9o+Xh+T","tlshash":"14a30263891101c9e621a18c1f1ffba34f4393abb66ce1f7ca0fe8c226479e182554f5","first_seen":"2023-09-18T04:47:43Z","last_seen":"2026-06-11T21:32:51.295435Z","times_seen":76,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/icon-4.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/icon-4.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-101a\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4122,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"c5ad0e9847c3915d249b6f01deb21cb4","sha1":"1b2e0835070ddeb3cd3c059fcd60a1ab623a6836","sha256":"63fb350eab09501edace3faaa74ffaec1ad90cc05d739c1640a33fb2bef17fa0","sha512":"bdcc362d327612bdbf438a10238ecb4fd50f9d27477af357b473f914e07f04ebde2ea705c1be79ef05de3e9293eb2d8f9f8792a728cfe462cb98fb7be2b07eb2","ssdeep":"96:4YkknmWIM8B/RturJHAU9I7TEvz3CCLJCPzjZVEWdYzVaGlRun2:Jkknd/g0I74GCt2fR0tlRun2","tlshash":"6d812b8ef9027c52538fde82b6e1128b2b2b4ac5b1c5c5c5fc9e58934861befe5c54c2","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.329115Z","times_seen":164,"resource_available":false,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/nav-3.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/nav-3.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-8a4\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2212,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced","md5":"fdfdc6ad0fad0e274e8f4b6e45c71ed0","sha1":"b078f727d4dbc20325b044a02d3b3237669412b0","sha256":"0e27358e465b262747200454aafeea36dd8f00845c24f0568b02ce911151d295","sha512":"f045bde6cb19dddfb8919be83e7d21778ebc87ce9914ae926da48c3faee89e38ca6ef81fb0c41741adcae3a42616b106c5a90537d0c4245cdafc673a4860b2d1","ssdeep":"","tlshash":"9741099ca9c7dd92959dc14018b650fadd2711c4cbb0e51694d9c4e7e9230f00abd0d7","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-24T03:06:11.18855Z","times_seen":281,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_usdz","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_usdz HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=usdz"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:37 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"978165c510398898992bc92480f3f9ae","sha1":"f573c5f54b7be3c29446206b1e97b210fbd5a55a","sha256":"81497d15e954afa69a69624a2e2b7be585c3cbdf488d5367602918234e760348","sha512":"ea08c8a8a3306c887d3fb64db609f65f854fd84fdaf50dd94c7f1e06afc465307970b8d3b58b38929508e3d43002bfef410cff48d93fd9911000db3043b4732b","ssdeep":"","tlshash":"6fc09be0b2318453056ad6d342d63bee54dd155bc05487528dfd8b7c16595347145464","first_seen":"2026-02-14T16:51:28.872808Z","last_seen":"2026-02-14T16:52:57.412932Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:42.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:42 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"84c3715691e74bb816dac29f6efa21e7","sha1":"1aa78b76ab0ad4fc74f21c902d86bdf28093268e","sha256":"3e4552dd71479602af8b85722326f719286947fbba96a7c9d9681bd4eb0f330a","sha512":"365e16f6bdafe70665f02f3412bcc79d7b1b3b7aa1f838ffbc1b5691b36b0e0a43818a227c7933be6312abf91d5d436cb086b8bbff3708498f41f404e1589d08","ssdeep":"","tlshash":"90c08ce07331a076002ac2d242ea27ee08890906c088c38289ad8bac16092243104010","first_seen":"2026-02-14T16:52:57.414485Z","last_seen":"2026-02-14T16:52:57.414485Z","times_seen":1,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/css/base2.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/css/base2.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-2aa8\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10920,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"9bf7ddb436613de79e3b73240759f7e6","sha1":"31ddade77dd7bec83394065e6fe25b8793f7e5ca","sha256":"51b4d735a0aa071ec8ffb4f6005b2a0b51eb4497c62d7c7051fa73decc653c8d","sha512":"69c7337badff898144456e029939a2ca8b89ea7cb1ac63873bdef41ca097c071326cf079d81a57ec7c5df483e1a3f49a23d27d9ceb958c5c3f05dec4241647d2","ssdeep":"192:7tf/mYMef7mWKFbzU9tRcsgC5+EYRbQs/2iBJ4x:xMv5VM5w//e","tlshash":"fa223054d2951163b137c7a61bb287e4ea2b80178743622c7ef4b7e48f618eb54b1fc8","first_seen":"2025-04-18T13:43:06.984375Z","last_seen":"2026-07-14T22:00:52.312025Z","times_seen":83,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Upload/public/62ac7f72d5c2d.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Upload/public/62ac7f72d5c2d.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-1a36d\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107373,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 405 x 580, 8-bit/color RGBA, non-interlaced","md5":"dd2066392e537ad6f96a5a405d305f7b","sha1":"c930aa7c4c03e8c1d551c22557a2ff0517b373c0","sha256":"e3a3d214112c78b57085f463705c3014d0c2e620af99145f9961d707136f1263","sha512":"ed785c118e1f0b601cffa363d7a34a87bdc54a1f235add132d68fde8a86b533e4d48251e48f337cddec36cd9e578c3f1b21b678014e84c7103cbbe48a8703635","ssdeep":"3072:J3H1uB6yrPriqyOPAPVzSaDOPLcGnDHngzqBz:J3V064xYPVz5DALcSKU","tlshash":"81a3125c5cd5211293cefdb113fbc4250e1ac0e8906d8be8ea8af1356deb8bc25671d5","first_seen":"2023-09-18T04:47:42Z","last_seen":"2026-06-11T21:32:51.286435Z","times_seen":78,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/5f8738fd439bc57.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/5f8738fd439bc57.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-9a9\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2473,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"430e14fa7ab62df82c9858bfa2682ece","sha1":"aa845a9abbffcbceee99934123b8e4e94b9ee52d","sha256":"20aa97f93b13e2de6de053d1d96a51ef8746a758973515f93b3f6e905c98f716","sha512":"bebb827e0a4525c0f7d3213a28fbde13be283e82d41ff86cfb216c98cdd5fa6515cd3403e2b0b2237635f46b0703c22359e797ca5bb0d3f660c4a1a287d600f5","ssdeep":"","tlshash":"f5511bd8fcdd3065d094b87b6b2121a25a831bc4f2807ae6f426c4495233c69076cfed","first_seen":"2023-05-01T18:49:36Z","last_seen":"2026-07-24T03:06:11.180787Z","times_seen":5002,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:34 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"667c4f86806da70c7dd1ab872219023c","sha1":"a63f10476caa7328d1ba8b52e92732f39e78a317","sha256":"4e6654caaf52bd1be063ef65de916ec5665cc8c5e36b4cd0c17492f7827168c1","sha512":"99749a2232d3ef6f390e5e821649547213eebe176d2a271409a760df9b849730109c57fa7d46761773ab3b928b06d3e567ee0c7979e427d5f650c82efeccef91","ssdeep":"","tlshash":"55c08cf07330501600a1e2f302eb37ee88ec9885c081c20249fdcb680e4aa24b089460","first_seen":"2026-02-14T16:52:57.419324Z","last_seen":"2026-02-14T16:52:57.419324Z","times_seen":1,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":324,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:44.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:45 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b8cd3969a0a1c41bfd8a1af590129898","sha1":"face7a0f280b87e960167e265a186db63f47bf80","sha256":"71d63504c00ca427972144f31a671c41a24cedc52cb52b64097d333d9fe783d2","sha512":"f61b1e537e09e8240843019c71c722b2352f06d5167d70ac2990bd173a811559f1fdd2f36cb97461441db87dcdd46ce86c38c2365e5629abe41e7a56b0d37fe0","ssdeep":"","tlshash":"b7e0c0e5b6bdc553247ac3d158c91b291cd60aa5c599d6060e7d1f6c0eac62c7227900","first_seen":"2026-02-14T16:52:57.421354Z","last_seen":"2026-02-14T16:52:57.421354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:52.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d6dccaf829dfb27c102ad80e3c2ce74d","sha1":"356302b4b8b9e1ad983789c7fb7d5614dfafd967","sha256":"a30bb8cc30baa516a550c327c19645fd1db3e0deb4645e76db8b1d9117b6a19c","sha512":"7cfabb1e9bc39dc1903e3aa83db0503398b08d164acc8c7ecce629ac6115435c24b80001e516907300e7b6a430bc206f095d0564356bedf2cdca24fcf8f98a95","ssdeep":"","tlshash":"e4c08ce07332a2221066c6d242fa2bef08880906c488c34289bc8bbc1a092282004050","first_seen":"2026-02-14T16:52:57.395488Z","last_seen":"2026-02-14T16:52:57.395488Z","times_seen":1,"resource_available":false,"data":null}},"time_used":506,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":506,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/bendi/css/bootstrap-icons.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/bendi/css/bootstrap-icons.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 23 Jun 2023 03:06:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64950c40-edbb\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60859,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"dbf1248779dc682a91ba529b5efe0ffc","sha1":"0eedcc3d0ec69d1a1b09f1af9c03f852a6f94152","sha256":"32cc4a47b370e278072a6440249872e681efa1d992600420c03a9631da885d70","sha512":"2e96320bb785273c91c136a4aba02268e2c9ebcc92998c24160331ec14f0f902132d21f4ac4cb130771dd20758bef407d589b1f8e3175796622edb162a517098","ssdeep":"384:vaqJVm8OAL1M+hQokEYm47U7yH2CYEjOnm4zH7fZ6aXoso1v/:Sqnm8OAL1Mzocm4KyH2CYEjOnm874soh","tlshash":"2c53cebad18f05f59341e4d92743674293a9ba7ce1817c7ad342399ee3c06188ad73ec","first_seen":"2023-04-05T06:29:21Z","last_seen":"2026-07-24T03:06:11.176999Z","times_seen":15148,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/iconfont.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/iconfont.js HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-d07e\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53374,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (53374), with no line terminators","md5":"cc853281f74275a23f48d5159bc04f48","sha1":"5065a6d8fef4c81d4f50a5aa20095c62733e623e","sha256":"a586f420effbe849c9026d8ab400f5f900826b5a1a01e091467b57224e897eb7","sha512":"f52c4b234e0ff8215f06491fc34ef3ec86ebf85baf8964ce6e76f5dc0d9507500cb83f2622fa0c3cbbf410b15f8760b10ca6a63e1a386d0c901675f74b7ff2c3","ssdeep":"1536:aAYIIXla1ajFDIiF7ma19kwCZZkNZuxhL7mk:XK+k4Nqk","tlshash":"a833b9f8976855fc9c0ec3ed9626a568230f9cfe79624928895e8f5097037dccb0788d","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-14T22:00:52.326736Z","times_seen":241,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:39.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:39 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"150d4a7de921663b20049e04d30f219d","sha1":"44dd5dba4fa1c13dd92c8dc672d3758ed75cf5ec","sha256":"a0ef14cc69341eccf8034b958151f5ab7692e95f87b2d4ef7a5bd05338617469","sha512":"394bb367dccf83a7e781890804a6a36f3535cbfb9f5d84cddc377f140a17c6aec1cdcb919ff8856531da5242de5ae27d3b912beabc7665e8687e8d562528b879","ssdeep":"","tlshash":"b980002022afa8a3028200288c0f000000ac38882ca080008c2822288a200228a00020","first_seen":"2026-01-25T21:02:29.649974Z","last_seen":"2026-02-14T16:52:57.400108Z","times_seen":3,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/nav-1-active.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/nav-1-active.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-ab3\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2739,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced","md5":"b1b87a6876b2c60990574150e89180cf","sha1":"53500dfbb709428debd3bf09b0781f59fbf57f45","sha256":"d91492c6e780bf0b7ede3e44ca7e21847b86e4b39742d25edef0bb1289604a77","sha512":"3d3ae328c14a6b6bc5d70b28e871ade8b5fc7e0e14b845309e78086c60ccdbcd345fee175f18ab9c1856c31f0c228bed9ad474e7be31c663af7fcd1d79582b46","ssdeep":"","tlshash":"a351b35ffe616c01a38cee457ee5a2979a3786805981b482fccd5883c4a10f4ccaedc7","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.322007Z","times_seen":180,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:36.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b4e35ce3955fe1c16b96a787fbbee999","sha1":"a48d070d8af68a09645b323d1c360c4704146ce6","sha256":"57f3ecd5095594fb4a48d11587e935d5ddec830ae6ebc5586ea25d3a81abef4f","sha512":"6df341442b1c8d96c17beb5a792c7985d0c2df5586c9d4b9cd95fa55c9eed62f26a5f15c4fd043231cdadff2c72afd9bd6934580c396b6fdd93d2e393f1bd4f6","ssdeep":"","tlshash":"c0e0c0e5b7bdc5132476c7d258c91b291cd606a5c5d9d6060e7c1f6c0eac62d7227900","first_seen":"2026-02-14T16:52:57.425858Z","last_seen":"2026-02-14T16:52:57.425858Z","times_seen":1,"resource_available":false,"data":null}},"time_used":855,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":855,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:44.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:44 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"84c3715691e74bb816dac29f6efa21e7","sha1":"1aa78b76ab0ad4fc74f21c902d86bdf28093268e","sha256":"3e4552dd71479602af8b85722326f719286947fbba96a7c9d9681bd4eb0f330a","sha512":"365e16f6bdafe70665f02f3412bcc79d7b1b3b7aa1f838ffbc1b5691b36b0e0a43818a227c7933be6312abf91d5d436cb086b8bbff3708498f41f404e1589d08","ssdeep":"","tlshash":"90c08ce07331a076002ac2d242ea27ee08890906c088c38289ad8bac16092243104010","first_seen":"2026-02-14T16:52:57.414485Z","last_seen":"2026-02-14T16:52:57.414485Z","times_seen":1,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:48.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"71c0cf9dc41ffbc3b5da23377a8f7317","sha1":"f0d85712398fe9d67383d2948e09ca9d22a775f2","sha256":"e45220b470744c69a1fb408dc47eecbbba999c4af55732eb5df3e26972ec839b","sha512":"e8428a156cca8ac938e7dd77b35363fc21fb727af1d7703c3174e8162a3532b8d528efc70f8135d16d1713a01e769c7b8cd6f7d5aab5338a8ece458193ec220f","ssdeep":"","tlshash":"d3e0c0e5b6bdc51324bac3d158c91b291cd60aa5c599d6060e7c1f6c0eac62c7217900","first_seen":"2026-02-14T16:52:57.427554Z","last_seen":"2026-02-14T16:52:57.427554Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1097,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1097,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_iota","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_iota HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=iota"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:35 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fa052269c5f8beffe5328fc6225766c4","sha1":"dc4fd464d4bef0f89030caf0333cb67a5097ae11","sha256":"39e95c186158a0a2aaceebea7e7866db42db5c16e723c27173cf45624cee259b","sha512":"204c23f450091dfa831bf5f88f02da70f712f95fcbb1c34ef507c7a1539d825b2a74bd6dd16d9b622a18c2258e1dc8a7a59ca0462465237dd50b5406efc83aca","ssdeep":"","tlshash":"73c08cb0b331401300a282d302ea37ef14e8884ac085c3828afdeba85a09220b199464","first_seen":"2026-02-14T16:52:57.429343Z","last_seen":"2026-02-14T16:52:57.429343Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:48.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:48 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d6dccaf829dfb27c102ad80e3c2ce74d","sha1":"356302b4b8b9e1ad983789c7fb7d5614dfafd967","sha256":"a30bb8cc30baa516a550c327c19645fd1db3e0deb4645e76db8b1d9117b6a19c","sha512":"7cfabb1e9bc39dc1903e3aa83db0503398b08d164acc8c7ecce629ac6115435c24b80001e516907300e7b6a430bc206f095d0564356bedf2cdca24fcf8f98a95","ssdeep":"","tlshash":"e4c08ce07332a2221066c6d242fa2bef08880906c488c34289bc8bbc1a092282004050","first_seen":"2026-02-14T16:52:57.395488Z","last_seen":"2026-02-14T16:52:57.395488Z","times_seen":1,"resource_available":false,"data":null}},"time_used":497,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":497,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Upload/public/62ac7f79b3703.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Upload/public/62ac7f79b3703.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-12dde\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":77278,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 405 x 580, 8-bit/color RGBA, non-interlaced","md5":"1821eb50b9cf4b90e413793e7014ae54","sha1":"9fe94fd28cc27e78220af692e8aa3f8b4a3df497","sha256":"ac77e5b2d1cc17c470cc9a0a683dd0f8307833b32fdcf012b3cde5be142d7afe","sha512":"68868e3d38cefcd766af40881c43191a2ae0a601b3bf8c29946fa257673b8008aa9eafebaf9f86a5a210a6b21ccdce4c5c53abfe1f24a411a47f832dfbad3ce3","ssdeep":"1536:lHJPySPvpUuA6bPk/6+TUHta311oHpn48dOhD4uiDheV:hPvOuAU+U8FeJ1dOhUNY","tlshash":"11730128b64eb37449f51c89c487c81162b1f7b0b7c87ece78255ca93abb678a91444b","first_seen":"2023-09-18T04:47:43Z","last_seen":"2026-06-11T21:32:51.296024Z","times_seen":66,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/nav-2.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/nav-2.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-51b\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1307,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced","md5":"bb9fda1cf4d738e8efe905fb76f0e689","sha1":"1964781e4b17c84e2988d1b8ccaedb2485251858","sha256":"9a9be208eaba722ecac1720bcbf252e2425e0b596fdd312ffc62c9a646e6e095","sha512":"0c407717f736e5451012b55e7d3ff8acd0c66ccbacfa8ac5b684669e0859ed1442f6150fcf39b5211a52c86312616991df17c8f2a3dd7ffdc98fcd4fe8e02bdf","ssdeep":"","tlshash":"5d2150dff751a4429099de4129f640b7c82749c09ee0f0a6f9c988aa9e250f548ae0cf","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-24T03:06:11.134472Z","times_seen":258,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_fil","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_fil HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=fil"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:37 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"edf0aba52d2c0ce69d2401b2a963b7c7","sha1":"2bc7455c9343c665eb477697c9b88f98869e6a9b","sha256":"1627c1407ef6f72076d3ead6c98a10242f6c1d5466116923195cf9d6490d762f","sha512":"77cb6222e562fea039b130dd4304c9c3282ea6ca0354ebe55f7a311f8c972e304b61500765cb0f13b5de9be16f1a4aef3c8618026a51a4e40b2064756fdb87e3","ssdeep":"","tlshash":"b8c08cf07331812301a186d302ea37ee04fc4559c180c60289edcb681a0a67072894a0","first_seen":"2026-02-14T16:52:57.432683Z","last_seen":"2026-02-14T16:52:57.432683Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/nav-5.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/nav-5.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-6b4\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1716,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced","md5":"9a21719103783d2a4a86efaafa58a0cb","sha1":"ee63b87a91f7bfefe0f3d2dcd9f355c22556f615","sha256":"def832d73b60afbaaa57b1666d316a1589c4bc4a8116b89f3efa7b71566215a3","sha512":"b8e69abdbffec49f7462bc7485c427acf9d886ba2b7be6294923ea28e339e7ef68e37bfc110783128567057a897ccd1e1ee7f57157ab15bb5a771f298d6a0959","ssdeep":"","tlshash":"9131d68dfa86f5824048918119f280e2b9178690eda0e050f9cee457cc351f151feccf","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-24T03:06:11.166484Z","times_seen":267,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ltc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ltc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ltc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:35 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":153,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"cdd7ea9d02d9193fcdfb3341265dc296","sha1":"eada56f7afe15db6358e957f66b50fef9d71daa4","sha256":"8f9134a81a82eeb3f2ba5cdb02b7702e870e648170e5f27295f73638b0262e29","sha512":"3b2f8a75d41bdd246a0f89f4ee00a0f721904c123ce0ec685110ea1d34ef663a24c84ca0b851f0cc2bfbc14c7275df66baac09029b315480bda0fa60cc7319e1","ssdeep":"","tlshash":"15c08cf0b330422700a58ad342ea37de44e8094ac09582428aadcf681e09224b1894a0","first_seen":"2026-02-14T16:52:57.435248Z","last_seen":"2026-02-14T16:52:57.435248Z","times_seen":1,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":947,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/5f87397132a8b02.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/5f87397132a8b02.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-998\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2456,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"bdaeb947a2eb31bae0a170559df9013c","sha1":"7fc8496c9bf51eea98dc9060262f87a792a24a43","sha256":"3225172adc122cc7f8f09fbcc94757061330651a485f17091f41726767f7ea3f","sha512":"710a1ac11f6fdb3915479bf6b9eccf34f4dedd8f30e6bed5275f52d1ec634a754b252e385eb9cd388a5a69c64aaf5818c13cb783090ae68a8696af067cb67341","ssdeep":"","tlshash":"9e512b90d3f3d98a7d930935f8b27a34cfda87da97098523ea834854e279442cd24943","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-24T06:15:58.027483Z","times_seen":19026,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/fil.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/fil.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-8bf\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2239,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"bc0baed91ad63da79ebfd092f42c76dd","sha1":"8a4f9cb9ee821242971e3f29a770e5078218bdf9","sha256":"ac4d8dcc1a755104c19551dcd96fbf097a93e529f86f540d8e0d55328c09a16d","sha512":"7cd155866ec8308b41049d32de0fa72b16dd774355f36ffba0f8256b1acaa2fe9fc5ae6695166f22c655aefe314b161d525f1cd8eb78ed746c3374905b0406bd","ssdeep":"","tlshash":"0e413eb67b9fc403c77f858708ed5e6544225f0a69248d50051a7e6ebd2f1e8c5915cc","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-23T14:12:10.58531Z","times_seen":3551,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/iconfont.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/iconfont.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-6b9\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1721,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0ac193fe14649438566603be860bd66e","sha1":"20c5621a0bc2a59db023844f82e979cd06f4d4b6","sha256":"c3debbd156909c8dc14c6117f1257ba232b8d30209842c57ba34388d1c52c667","sha512":"30d89b8bc6575d3ebfa689ad015500ab4ca31b4ab178461626b1187383e2f1f8fd7ec3223216f248549d7016ede38f9e8c4f291c8982ac654984faab3b602309","ssdeep":"","tlshash":"7431a9d4d87d2cb05358d5d46312b664ef0963b98e8b4c5bf6937d9ca6e331090c2acc","first_seen":"2024-05-09T07:39:48Z","last_seen":"2026-07-24T03:06:11.160518Z","times_seen":179,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/icon-5.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/icon-5.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-d86\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3462,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"f0ea37903532b7ac1f5470bb4d5dfbf1","sha1":"16f1da1a057ba26880ac40c3c5cb0409eab4ae0e","sha256":"005ecc8614a9e4c727f6ee6ed11587ac269c24a981b536d4b71b0791a1fb9207","sha512":"6a0978f8386639ef1be2324286bc524202907c74140029dd3b2075dff6ebe7a7720a41d9b5ef4977be4d493ce4c963e9efc244f572d529695c92078eb7e8bdcc","ssdeep":"","tlshash":"3961394eea1418010b09ea561ef59243c7178aa02faafd84dcfd8d97467a0c44deccd6","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.275622Z","times_seen":343,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/1613786513998262.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/1613786513998262.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-adc\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2780,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"856bfdb63dc0d6fad6b92fc6a29719e1","sha1":"2fed2e3409ce1bbbfb37f6da4abeecc30cefc021","sha256":"eebe29898b8b7de5c9e47daab474152be8095e3ab42d768b84b085c5a12b95c6","sha512":"a61c0a108d63c89ae62a2b03108480b5c08bda0e80049089a2a84cd7973bd9e94dcd2902e166b92e1d7ad5b7356357c9b181cb1b6051dd25913e82d2420154f0","ssdeep":"","tlshash":"51518cc7a707f33a9c866161bed44509f244d80a8160b31c0f33a7572c8a83ea4f324f","first_seen":"2023-05-01T18:49:36Z","last_seen":"2026-07-24T14:31:24.360229Z","times_seen":22262,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:44.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:44 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"150d4a7de921663b20049e04d30f219d","sha1":"44dd5dba4fa1c13dd92c8dc672d3758ed75cf5ec","sha256":"a0ef14cc69341eccf8034b958151f5ab7692e95f87b2d4ef7a5bd05338617469","sha512":"394bb367dccf83a7e781890804a6a36f3535cbfb9f5d84cddc377f140a17c6aec1cdcb919ff8856531da5242de5ae27d3b912beabc7665e8687e8d562528b879","ssdeep":"","tlshash":"b980002022afa8a3028200288c0f000000ac38882ca080008c2822288a200228a00020","first_seen":"2026-01-25T21:02:29.649974Z","last_seen":"2026-02-14T16:52:57.400108Z","times_seen":3,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Mobile/images/icon_spot.svg","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Mobile/images/icon_spot.svg HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 04 Jul 2022 17:20:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c32150-d56\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3414,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b9173c7118cffbc6ea4ef1e6c20e4bab","sha1":"5caaba7b45bdb9ebd87eaf00cb7d04053022e235","sha256":"dc4a7979499afcc53ea27b04aa47f45d44f8296766a2d22916ea22f81c94c5d6","sha512":"d35f4ac8b71dbe24078b21326f9e609070720c46580a92cbab934e7e74e19ea15e66d9e008ae125569ee7fc3a7eaf7b2ad243146e9dc22e52efd0a73cfd8f51d","ssdeep":"","tlshash":"746182ed3ba1c2b8a091b1e2df1120ea789914ec3b846651d121be6d3d9107dcced4ca","first_seen":"2023-09-18T04:47:44Z","last_seen":"2026-07-23T17:19:49.144894Z","times_seen":152,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b4e35ce3955fe1c16b96a787fbbee999","sha1":"a48d070d8af68a09645b323d1c360c4704146ce6","sha256":"57f3ecd5095594fb4a48d11587e935d5ddec830ae6ebc5586ea25d3a81abef4f","sha512":"6df341442b1c8d96c17beb5a792c7985d0c2df5586c9d4b9cd95fa55c9eed62f26a5f15c4fd043231cdadff2c72afd9bd6934580c396b6fdd93d2e393f1bd4f6","ssdeep":"","tlshash":"c0e0c0e5b7bdc5132476c7d258c91b291cd606a5c5d9d6060e7c1f6c0eac62d7227900","first_seen":"2026-02-14T16:52:57.425858Z","last_seen":"2026-02-14T16:52:57.425858Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2014,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2014,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:36.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:37 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"2262d891d5afb571967fd5983d150a74","sha1":"bbdc7d9ae139fc995bdd1ee69556fa4d08c21f9d","sha256":"dccb80b011c9205d558ad11500aa105ecdcedcd83b1bdbdf738404bb5dd7056a","sha512":"86973b144f77f524f6856c89073dd35f68fced218e3c0ba6ea84849527b580cc768b2363133fe3aad44c0ba63d19126f51bf3c73a52ca512d0f17a55274df774","ssdeep":"","tlshash":"ddc08cb0b332502a0422cad242fa27de44890407c0c8838289ac8fac1a092242005050","first_seen":"2026-02-14T16:52:57.390535Z","last_seen":"2026-02-14T16:52:57.390535Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1725,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1725,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:38.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:39 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b4e35ce3955fe1c16b96a787fbbee999","sha1":"a48d070d8af68a09645b323d1c360c4704146ce6","sha256":"57f3ecd5095594fb4a48d11587e935d5ddec830ae6ebc5586ea25d3a81abef4f","sha512":"6df341442b1c8d96c17beb5a792c7985d0c2df5586c9d4b9cd95fa55c9eed62f26a5f15c4fd043231cdadff2c72afd9bd6934580c396b6fdd93d2e393f1bd4f6","ssdeep":"","tlshash":"c0e0c0e5b7bdc5132476c7d258c91b291cd606a5c5d9d6060e7c1f6c0eac62d7227900","first_seen":"2026-02-14T16:52:57.425858Z","last_seen":"2026-02-14T16:52:57.425858Z","times_seen":1,"resource_available":false,"data":null}},"time_used":922,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":922,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:49.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eos HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"150d4a7de921663b20049e04d30f219d","sha1":"44dd5dba4fa1c13dd92c8dc672d3758ed75cf5ec","sha256":"a0ef14cc69341eccf8034b958151f5ab7692e95f87b2d4ef7a5bd05338617469","sha512":"394bb367dccf83a7e781890804a6a36f3535cbfb9f5d84cddc377f140a17c6aec1cdcb919ff8856531da5242de5ae27d3b912beabc7665e8687e8d562528b879","ssdeep":"","tlshash":"b980002022afa8a3028200288c0f000000ac38882ca080008c2822288a200228a00020","first_seen":"2026-01-25T21:02:29.649974Z","last_seen":"2026-02-14T16:52:57.400108Z","times_seen":3,"resource_available":false,"data":null}},"time_used":725,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":725,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:50.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"71c0cf9dc41ffbc3b5da23377a8f7317","sha1":"f0d85712398fe9d67383d2948e09ca9d22a775f2","sha256":"e45220b470744c69a1fb408dc47eecbbba999c4af55732eb5df3e26972ec839b","sha512":"e8428a156cca8ac938e7dd77b35363fc21fb727af1d7703c3174e8162a3532b8d528efc70f8135d16d1713a01e769c7b8cd6f7d5aab5338a8ece458193ec220f","ssdeep":"","tlshash":"d3e0c0e5b6bdc51324bac3d158c91b291cd60aa5c599d6060e7c1f6c0eac62c7217900","first_seen":"2026-02-14T16:52:57.427554Z","last_seen":"2026-02-14T16:52:57.427554Z","times_seen":1,"resource_available":false,"data":null}},"time_used":902,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":902,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:52.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/1613786496962262.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.744Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/1613786496962262.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-a83\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2691,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"2edf1ef8b333c40979976d1a49bc234c","sha1":"d75ac12795b4a9575c874e1b190712cd62a87afc","sha256":"50a1901684f223bf26594dd3415b1e50f184820a16daa810cc5452911e9117a9","sha512":"f697a1fa0786316fc01003f72621920932e2657e4acf5a471e35d02717c42c9db5a12df311895a776a563dcae9b8fc0b6721833529a054b9dbfff4c52fc564d3","ssdeep":"","tlshash":"2b515ee60252267980d32438616db1e178beabb2c3021ded6c1444954acc4b62555cfa","first_seen":"2023-05-01T18:49:36Z","last_seen":"2026-07-24T06:15:58.255076Z","times_seen":22710,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/1594057379245582.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/1594057379245582.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-c13\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3091,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"033d340b5a4a22d8e8590b98409158f3","sha1":"098ef5ee4b44f780df7f39c022ea491cacb32e7f","sha256":"0b53847e742884cbfbc563109bb99cacbc75fbb1bca892a1dbf68982e68778a0","sha512":"60de2b9014037bbd2f081ffe295d2cd0d0772bfc9b878986404981aff8df34a51611ffe2d214e0ce8f3849f9f9bda9e52b650d50db089953fde9bbb5b9725339","ssdeep":"","tlshash":"03512bcb908c59b6afe24ea002945ce48021c177ad3b4726963ae91e9f742f6070dc62","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-23T14:12:10.597879Z","times_seen":3317,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/4558.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.760Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/4558.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-48b0\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18608,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 199, 16-bit/color RGBA, non-interlaced","md5":"c7e59bbd0ca773c704b906e229ca8383","sha1":"e191e030bfffacaa1b53ea83121a03955fd080ba","sha256":"22e62f07c3d37c4e0b8f717bda7ac0c60362fb80380c9f6def693dd4f9b4567c","sha512":"69dfd5a8bec0c1533adde28c322e96dcf9236b934a21668bc435f55f3284258881937ff92573a64188b4cd3ccd52f6d485eb4d864d4da0806753c71e385212db","ssdeep":"384:KR6xVqHk99Lm0m9/zkJMPoqgN09WuJFNFHaV2zbj69VmO:tvQk99K0m9/zQLqGeDJ9HHzbjnO","tlshash":"d682e0a4850add63e0b15bb72bad2753cd3d3a2020d4b2b53ebb09b468f090657a4ec4","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-24T03:06:11.144131Z","times_seen":3387,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/jst.svg","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/jst.svg HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-4b7b\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19323,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b993b0a39d50c323edbb5886a19d56cb","sha1":"8e183944ff4dd3741c2b18f3a2d8962b1662b1a4","sha256":"450fcc35ab762f1b121f48150a7465b6a506fee918e24a80811134ee3a1d88c6","sha512":"754b0b31db60b3b2b0b2dcbc5f32e950bd8245c08d60d4d84a8bfd7a887167dd636d8f001232639952575ac6d2ac97103c66e04a016502472412283cffd680e6","ssdeep":"192:cu7OzkWdAPKtyK2Pe+6fsKO2uY/E4vVAAm7gbK1QQlS/exkPXGmZ7ayFePl5a0FJ:cuiz5dU7h2QuagXq36Np2aE/ao54Cgq","tlshash":"6a82238d9f564f6a9485b3fdafea5050648740ec39a8e2f4e7b44473f80c6a50c48de7","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-23T14:12:10.551714Z","times_seen":3167,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/bendi/js/jquery.min.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/bendi/js/jquery.min.js HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 23 Jun 2023 03:06:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64950c4c-14938\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84280,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32061)","md5":"d021c983bd6e7291b43a5cc1fb2ebe99","sha1":"ffe47a16e4b1550ddfba3577cc9cc9fdc8643aff","sha256":"c0d4098bc8b34c6f87a3d7723988ae81214a53a0bb4a1d4d36a67640f98ed079","sha512":"0b01d408ae79a4e3630f1bcf6507aec0aa71a2cf263f212ff601ae582f15af4df9ec9dae5e0d4fc9c1833cd0fd1207689121531ba920480a680e3f4e336da4b3","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa9G:7NMnJiz6oAQKP5a98HrB","tlshash":"5983d6d9b6c27062977734b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T12:01:55Z","last_seen":"2026-07-24T03:36:26.08517Z","times_seen":10248,"resource_available":true,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":360,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:37.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:37 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:40.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:41 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b8cd3969a0a1c41bfd8a1af590129898","sha1":"face7a0f280b87e960167e265a186db63f47bf80","sha256":"71d63504c00ca427972144f31a671c41a24cedc52cb52b64097d333d9fe783d2","sha512":"f61b1e537e09e8240843019c71c722b2352f06d5167d70ac2990bd173a811559f1fdd2f36cb97461441db87dcdd46ce86c38c2365e5629abe41e7a56b0d37fe0","ssdeep":"","tlshash":"b7e0c0e5b6bdc553247ac3d158c91b291cd60aa5c599d6060e7d1f6c0eac62c7227900","first_seen":"2026-02-14T16:52:57.421354Z","last_seen":"2026-02-14T16:52:57.421354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1117,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:42.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=get_market_one HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b8cd3969a0a1c41bfd8a1af590129898","sha1":"face7a0f280b87e960167e265a186db63f47bf80","sha256":"71d63504c00ca427972144f31a671c41a24cedc52cb52b64097d333d9fe783d2","sha512":"f61b1e537e09e8240843019c71c722b2352f06d5167d70ac2990bd173a811559f1fdd2f36cb97461441db87dcdd46ce86c38c2365e5629abe41e7a56b0d37fe0","ssdeep":"","tlshash":"b7e0c0e5b6bdc553247ac3d158c91b291cd60aa5c599d6060e7d1f6c0eac62c7227900","first_seen":"2026-02-14T16:52:57.421354Z","last_seen":"2026-02-14T16:52:57.421354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":922,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":922,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/img/flag/tw.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/img/flag/tw.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-3f34\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16180,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 326 x 326, 8-bit/color RGBA, non-interlaced","md5":"81bde41924475282258f39e34caed3ef","sha1":"9e7a9f8944a9b2179fbbb5d1d83a63109cbe31c4","sha256":"ef8935f9f539165dbc4966c22cb7ee286d8b44107290669460b39e10e4076aa6","sha512":"386d901b1efec6d38258fbf52afbf866a414fca622e1635ef48091c2bd2701757d044ff019d84e7ddfaeefeefb03457ec24382d0b88977f618771b38bcaf6ef5","ssdeep":"384:04n4HSy/I8nPgrQMgYgqEqb80BY6j07cXzSh9liy:zUSyAAYEMgYd/aXUy","tlshash":"1f72d0a0db15f942d909a8983da303538eaa54c98be7533b7fb644bd39902f5140bdcd","first_seen":"2023-10-08T14:42:00Z","last_seen":"2026-02-14T16:52:57.44527Z","times_seen":32,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/doge.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/doge.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-838\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2104,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 61 x 60, 8-bit/color RGBA, non-interlaced","md5":"ff0c62c872d877837881793431cf064c","sha1":"8ee9cdfe43cfba24078529fa23984ab9e9d99a76","sha256":"c146f8822178b5581dd5eb80071e9824e1634252a4cd0d25b9675b0cb3da570e","sha512":"2416ae2389993012befe574c4ee91c47b6101f3e89b7582d25ce214e248e5305f327183c2a7222259b9aeae09ff7315edeae1ff11c8be3304ca11d5cefeb09ff","ssdeep":"","tlshash":"b0416e07f3ddbe79ccd66bb71348e024d01ff7e1b8010b98a42a4c565258c6f215c44b","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-23T14:12:10.526108Z","times_seen":5393,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/nav-4.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/nav-4.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-867\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2151,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced","md5":"1e639c91b02ce12d5e22a4c476238425","sha1":"599883b3bade960e7e16b61711656d0c27b09a44","sha256":"d901667f0f5b32daba208fa9b77f2aba4430e6aa2066baafdb63e0a54b7c63d8","sha512":"734b3de8f5d687f637b5e86e6431d47b63f098de109ab88a117e8410c2aa434e9743475c5353c345a08d33c61df791e367e6ae76dc9ef4d2304557e30d0c50d4","ssdeep":"","tlshash":"4541e58df744b841e188d84228f785678b27558088f1d56afc8ec89be9725f8487e9e3","first_seen":"2023-07-15T10:38:22Z","last_seen":"2026-07-24T03:06:11.189175Z","times_seen":256,"resource_available":false,"data":null}},"time_used":362,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":362,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/favicon.ico","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:36.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:36 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 62719\r\nlast-modified: Sun, 25 Jan 2026 19:50:37 GMT\r\netag: \"6976740d-f4ff\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62719,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"d7341c22ca17a5aff780dcef79080785","sha1":"ff37e0cf60725dcc2fb8a140963a48212ed4f5c3","sha256":"50b16181662620689fb32d40072d31a2e3e1bf8f6b91d8f44a78c33734041dca","sha512":"1cfccb99cce4bb42e1fc75775c6715b585a2ee1c3a78106e7210aff735eb07820503fd7098648f175256e815274246294e43c9a7812926c608a647f33665a2c1","ssdeep":"1536:mydN+XymhJsmTKsWtVDZS+8IzB1YI8zXS3n9/+N2:1gJsmWsWXDZS+7/9mN2","tlshash":"165302cc8a235dc6b3f53a9d96504088c6a2a960ee9d5635f057cb1fb22bf0f55c03da","first_seen":"2026-02-14T16:51:28.874994Z","last_seen":"2026-02-14T16:52:57.448107Z","times_seen":2,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":96,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:40.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:40 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"84c3715691e74bb816dac29f6efa21e7","sha1":"1aa78b76ab0ad4fc74f21c902d86bdf28093268e","sha256":"3e4552dd71479602af8b85722326f719286947fbba96a7c9d9681bd4eb0f330a","sha512":"365e16f6bdafe70665f02f3412bcc79d7b1b3b7aa1f838ffbc1b5691b36b0e0a43818a227c7933be6312abf91d5d436cb086b8bbff3708498f41f404e1589d08","ssdeep":"","tlshash":"90c08ce07331a076002ac2d242ea27ee08890906c088c38289ad8bac16092243104010","first_seen":"2026-02-14T16:52:57.414485Z","last_seen":"2026-02-14T16:52:57.414485Z","times_seen":1,"resource_available":false,"data":null}},"time_used":521,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":521,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:41.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_doge HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:41 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":157,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9306fccd0e9452cc7fe9ec273c668c6a","sha1":"63656d08aebafd3d971a553328eadc4e4dcbee40","sha256":"96ba0a924b55d447c8cb5e748b86550de034d19d6462cc406b70149ec0354935","sha512":"ada0ceddbae941da2bd9f48560d0ee2647d6a26ea2266d97d4a6776d3f6e19b3bb59e5229836837cbafed201e3dcbcb3b9e650251761cbda4e9d90792dc77985","ssdeep":"","tlshash":"43c08cf07770412210a9d6e302ea37ee04ec6986c081820289fdcb280f49628708d460","first_seen":"2026-02-14T16:52:57.449524Z","last_seen":"2026-02-14T16:52:57.449524Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:43.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ltc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:45.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ltc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ltc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:45 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":153,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"37c9c70c36ab33561e67c2ce9f87ad53","sha1":"83c016b342373e8dc05f7cd1188d9785c8227bb6","sha256":"ebbe209be4134743bd7856c614c1768dbf158c9b6ee7458435659f38fe6e8284","sha512":"c059f735b27fd172d0f630382a9a39e98b21782e9dd57e5dbcf0420ab69723791c841564ada742e57b6bf178e592850de4bdd945e1ceed6654fdad0c8e1e7faa","ssdeep":"","tlshash":"7dc08cf0b330422301a19ae302fb3bde48e80a49c094c2428aadcf681a0921474894a0","first_seen":"2026-02-14T16:51:28.871466Z","last_seen":"2026-02-14T16:52:57.4512Z","times_seen":2,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/js/layer/layer.js","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/js/layer/layer.js HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 04 Jul 2022 17:20:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214e-4d83\"\r\nexpires: Sun, 15 Feb 2026 04:52:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19843,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19752)","md5":"666f4437565d197e9459e19a29f58315","sha1":"afc5c0a1369137e52b37ad5fb63f48202ce31368","sha256":"4a49651ad86a83ecbd9c2ad34e7f5c906b46ae2c4c93c1c8585148f936b7e100","sha512":"1e659ff6c47458dbbaf7e7561402c12441286c255ddec048bf654388e8666a9ceca344e166657c29fce4a08b46470b44c47e8f1c6f577adc2a4e4f4f0e7e1e90","ssdeep":"384:DQ8cuj0z4VfS7ShA3BMJOoM6bs7hwI9b4Zrxy:DQtu8CfS793QODbcI","tlshash":"5f92c85ab5503593216390a9911fa90f30f24d22eb078958f16bf1fd1ebcda562b3f0b","first_seen":"2023-04-11T09:52:52Z","last_seen":"2026-07-24T13:58:42.996856Z","times_seen":14045,"resource_available":true,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":360,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/js/layer/skin/layer.css","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/js/layer/skin/layer.css HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214e-36e0\"\r\nexpires: Sun, 15 Feb 2026 04:52:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14048,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (13967), with CRLF line terminators","md5":"1673a003559ea1607dd77e6467a4baed","sha1":"954f4afa17e3d1c057101e62950f6c9506245550","sha256":"9748f440829e0b76d70f344e9c989f6d2302eba81aeea03211d40ef5f29fe62a","sha512":"5f9b8254fe18cdc329ca87a4852b7cb5520dcf3c406c5b3d755e99d0e7ddd618cd5ca2b455868ae14d896431cea2252b60d79d5fdd9e404a1fb8685a05ceb955","ssdeep":"192:9OcW0PmLeWVNrzztBm0T9zBKgwBnsY5Cb+RX:9PW0ijV1JbTyGY5CGX","tlshash":"1c5202e144811299b0278611d6dcbeba32f88d53e5630dbef2573c1f874c6dba2b6247","first_seen":"2025-04-07T11:37:37.344268Z","last_seen":"2026-07-24T03:06:11.145857Z","times_seen":3271,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_bch","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:43.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_bch HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:43 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":153,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f28399e9990500b35ff492f7ca0a6fb6","sha1":"9968e96e685a40c4c65156f820e6258f55b9a8fa","sha256":"5ccf5290aa433a7d6531ea1d284e46fdcccd548013a23f5cac4677e95c524929","sha512":"f9411a1662d7ce57732b4885aa72e7a0e9e5bea85538e203f32bd95557c7f0f3d8665f7e9cedf0f82b276e6572e763d6a4e5d9dc5aae0cd4e02bbbb0a14d87cc","ssdeep":"","tlshash":"40c08ce03330c026002ad2d262ea2bfd08ac0946c094c2028aac8b2c061d1383008450","first_seen":"2026-02-14T16:52:57.455733Z","last_seen":"2026-02-14T16:52:57.455733Z","times_seen":1,"resource_available":false,"data":null}},"time_used":506,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":506,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_flow","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:51.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_flow HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=flow"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3048f6d9f2a001236e06b198094bdccd","sha1":"eae0d0b134e1c4dc372f3c0477430ce4835f014c","sha256":"5c13da808fa832b1c6fcfbe7dd24a41e3c8df73ac542734966ce3f37271a7541","sha512":"6d9e9cde0cd06a76c727d5186fd6391cdd89b8c370ab3187ee225cfad6835f88323b9ecab373f9550c8822bd1bdcfec20a6f58aa2d2a0fde6ed688f723f06135","ssdeep":"","tlshash":"0dc08cf07330511200a192d203eb37ef48e88986c084c2024abdcbb80f5926470894a0","first_seen":"2026-02-14T16:51:28.906405Z","last_seen":"2026-02-14T16:52:57.457317Z","times_seen":2,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-14T16:52:32.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: text/html;charset=utf-8\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nlocation: /Trade/tradelist\r\nset-cookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; path=/\nserver_name_session=d3b42960c1dda9407529085368284407; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":42680,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T14:51:02.558956Z","times_seen":17504897,"resource_available":true,"data":null}},"time_used":502,"timings":{"blocked":198,"dns":1,"connect":95,"send":0,"wait":105,"receive":0,"ssl":100},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/Public/Static/Icoinfont/icon/icon-1.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /Public/Static/Icoinfont/icon/icon-1.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-1309\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4873,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"e89b38aa645c015f2d80997da6f3ba08","sha1":"3945c7dbce3379436d370ebd16a9e12f06bf13ee","sha256":"74e730cfc19f00018c8e6f3ddd4b81dbb0c0dd64196d5b95cdd055226a92edcf","sha512":"6e4df7d3b4890fbac983f854323c25c074e6da63f5aebcb53e56bb7fdbcf361399d89c4d54c9dee2d9060ed80a42ca1e39cd493fe3d6a7bffc035f727c63a511","ssdeep":"96:4YkknmWIM87/EHAUDz+YZpTHiutt4uQfkuiPnF3j9nolnu+gTIVJ:JkkndNgYz+cCu4ului/Lnolnv40J","tlshash":"24a16ca3f691798117096e832fdfd99b4d268a0005e29859f8fd5c1391260fe5cdced3","first_seen":"2023-09-16T07:24:25Z","last_seen":"2026-07-14T22:00:52.31258Z","times_seen":170,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_bch","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_bch HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:34 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":153,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f28399e9990500b35ff492f7ca0a6fb6","sha1":"9968e96e685a40c4c65156f820e6258f55b9a8fa","sha256":"5ccf5290aa433a7d6531ea1d284e46fdcccd548013a23f5cac4677e95c524929","sha512":"f9411a1662d7ce57732b4885aa72e7a0e9e5bea85538e203f32bd95557c7f0f3d8665f7e9cedf0f82b276e6572e763d6a4e5d9dc5aae0cd4e02bbbb0a14d87cc","ssdeep":"","tlshash":"40c08ce03330c026002ad2d262ea2bfd08ac0946c094c2028aac8b2c061d1383008450","first_seen":"2026-02-14T16:52:57.455733Z","last_seen":"2026-02-14T16:52:57.455733Z","times_seen":1,"resource_available":false,"data":null}},"time_used":735,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":735,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_jst","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_jst HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=jst"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:34 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6b6d74a64d60e5687790bf63e0bf09ee","sha1":"719e1aa5a95af986618c35c6e88b87d4c626c828","sha256":"a6f517dc909ee73afc575a749f9b424bf9004ea135aec92d0299251f5ae1aa74","sha512":"45b08cd992b910417cf2a84c1490e528bb0ae0fed5f6f250fe276a06a3a2675bc76264063f7704d18ac071a6a829a5e12b1de6bf82b3f6231783a4dc93f2ac22","ssdeep":"","tlshash":"1cc08cf0333041620826c6d202fb27ed08c82406c5d4c3028abdcb2c060a1246004010","first_seen":"2026-02-14T16:52:57.46039Z","last_seen":"2026-02-14T16:52:57.46039Z","times_seen":1,"resource_available":false,"data":null}},"time_used":529,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":529,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:46.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_eth HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:46 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ef8e8dc0b9c6ee4a04e2515b4fae95ce","sha1":"d247f5b74ee1ad2fbdfe5c107a7ee4c524bc49c5","sha256":"2bd0d44b881b4a27485ace516b557e39fa3b0b3bb6b9becfdb5f62574088d185","sha512":"2fe0946b281e8584e9a8fd7b884d7c74d887e8779034b1d8bae1b1657d44c26698d817bc30aa9498da60d81fefd6a90f5000fac0c17ce8ae7ad65fd616f93951","ssdeep":"","tlshash":"85c02be4733046630026ead242eb77ed04dc050bc0c8c3428efd8bbc160e1283144410","first_seen":"2026-02-14T16:52:57.392462Z","last_seen":"2026-02-14T16:52:57.392462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":317,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:46.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_btc HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:46 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"48369ecb6c16edbf674e1385d163608f","sha1":"dde513e74ffac0128f7cb6e376e3971dde50bf75","sha256":"7750d1eeccb967c58c9eb4c78bb89f2f73c82fec2bbc17890e0a316824533f1b","sha512":"bf1d65e64d0ab9b73322b02c3c350f6a1008f10a173bf1fa80153614dbcaf2f585ba82cfee723ee7c38f9c7064c027aa5eb078bb268126fb8dac46d71c2435b2","ssdeep":"","tlshash":"b4c08ce07332a232002ac6d242ea27ef08880806c488c34289bc8bbc1a092283004050","first_seen":"2026-02-14T16:52:57.461941Z","last_seen":"2026-02-14T16:52:57.461941Z","times_seen":1,"resource_available":false,"data":null}},"time_used":514,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":514,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_fil","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:49.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_fil HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=fil"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"edf0aba52d2c0ce69d2401b2a963b7c7","sha1":"2bc7455c9343c665eb477697c9b88f98869e6a9b","sha256":"1627c1407ef6f72076d3ead6c98a10242f6c1d5466116923195cf9d6490d762f","sha512":"77cb6222e562fea039b130dd4304c9c3282ea6ca0354ebe55f7a311f8c972e304b61500765cb0f13b5de9be16f1a4aef3c8618026a51a4e40b2064756fdb87e3","ssdeep":"","tlshash":"b8c08cf07331812301a186d302ea37ee04fc4559c180c60289edcb681a0a67072894a0","first_seen":"2026-02-14T16:52:57.432683Z","last_seen":"2026-02-14T16:52:57.432683Z","times_seen":1,"resource_available":false,"data":null}},"time_used":509,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":509,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/xm/5fc.png","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:33.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"GET /xm/5fc.png HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 04 Jul 2022 17:20:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3216c-a86\"\r\nexpires: Mon, 16 Mar 2026 16:52:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2694,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"6ad5509616a5fca9f389801052bea3fe","sha1":"5b53d204b7e6066409067fba9fce5202ff20e9d6","sha256":"6becc3abea448b67731610708852a70c3ceb99059b2dee98da3711dc0620218a","sha512":"18729e5d7521224c032a2a7f18c154b1d02905dda6a06dc3a1af5d876bc5f651b78699589772cd6158bc1bfa75aead83b084bca2b06539a3e4cc9b4a6d476ded","ssdeep":"","tlshash":"ed512be6a252222ac78335be8a25f1dbdf560afb123220858088c13aa40f750c98a573","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-07-24T06:15:58.032223Z","times_seen":19477,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":368,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_flow","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_flow HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=flow"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":154,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3048f6d9f2a001236e06b198094bdccd","sha1":"eae0d0b134e1c4dc372f3c0477430ce4835f014c","sha256":"5c13da808fa832b1c6fcfbe7dd24a41e3c8df73ac542734966ce3f37271a7541","sha512":"6d9e9cde0cd06a76c727d5186fd6391cdd89b8c370ab3187ee225cfad6835f88323b9ecab373f9550c8822bd1bdcfec20a6f58aa2d2a0fde6ed688f723f06135","ssdeep":"","tlshash":"0dc08cf07330511200a192d203eb37ef48e88986c084c2024abdcbb80f5926470894a0","first_seen":"2026-02-14T16:51:28.906405Z","last_seen":"2026-02-14T16:52:57.457317Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crostw.net/index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ht","fqdn":"crostw.net","domain":"crostw.net","tld":"net"},"ip":{"addr":"147.124.195.148","port":443,"asn":209043,"as":"IPRoyal Services FZE LLC","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://crostw.net/Trade/tradelist","date":"2026-02-14T16:52:34.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.crostw.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Feb 2026 02:50:17 GMT","end":"Mon, 04 May 2026 02:50:16 GMT"},"fingerprint":{"sha1":"2E:A4:FD:2E:07:BD:D1:0D:F0:5A:0E:C2:B0:F3:8C:AB:55:F5:ED:E0","sha256":"67:92:E6:74:52:AE:FA:B9:45:53:BA:99:7B:43:76:5E:21:39:48:1F:E9:82:AD:EC:0D:E4:57:F6:B9:98:CA:F2"}}},"request":{"raw":"POST /index.php?m=Mobile\u0026c=Ajaxtrade\u0026a=obtain_ht HTTP/1.1\r\nHost: crostw.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 7\r\nOrigin: https://crostw.net\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crostw.net/Trade/tradelist\r\nCookie: PHPSESSID=78nu8pan5fvg7n5c9ae9at60ob; server_name_session=d3b42960c1dda9407529085368284407\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":7,"data":"coin=ht"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 14 Feb 2026 16:52:35 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"150d4a7de921663b20049e04d30f219d","sha1":"44dd5dba4fa1c13dd92c8dc672d3758ed75cf5ec","sha256":"a0ef14cc69341eccf8034b958151f5ab7692e95f87b2d4ef7a5bd05338617469","sha512":"394bb367dccf83a7e781890804a6a36f3535cbfb9f5d84cddc377f140a17c6aec1cdcb919ff8856531da5242de5ae27d3b912beabc7665e8687e8d562528b879","ssdeep":"","tlshash":"b980002022afa8a3028200288c0f000000ac38882ca080008c2822288a200228a00020","first_seen":"2026-01-25T21:02:29.649974Z","last_seen":"2026-02-14T16:52:57.400108Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"crostw.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}