{"report_id":"22e2ae04-d6bf-4abd-ae24-141c304c0136","version":6,"status":"done","tags":[],"date":"2026-01-30T06:38:51Z","url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"172.67.164.116","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"title":"The Best Crypto \u0026 Binance Bridge | CrossBridge","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"172.67.164.116","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-06T06:38:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cbridge.celer.network","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cryptrouter.xyz","ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-26","domain_rank":0,"first_seen":"2026-01-30T06:38:52.474929Z","last_seen":"2026-01-30T06:38:52.47493Z","alert_count":57,"request_count":19,"received_data":6321813,"sent_data":8793,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]}]},{"fqdn":"cbridge.celer.network","ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2018-01-26","domain_rank":0,"first_seen":"2021-07-05T06:23:29Z","last_seen":"2026-01-21T11:28:29.072614Z","alert_count":1,"request_count":1,"received_data":7766,"sent_data":439,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"64cbf8e7a556a18a48e53d9812dacaee","sha1":"0592aceb53f9f89c415200346c89b7f34b646f4f","sha256":"e24e5ffa482680b2ac23dbccb58081dc0127e50c94acc0ff2f7fd4fe102b8284","sha512":"56970ebe7937d39f77bcda3253318bbb49906b06469c05d1afbf2ac4655717937596605059f9eea3dc984dcf308ee7a9c05c5e3314990f079e2553555824b76c","ssdeep":"","tlshash":"35e02b286aa755fd36b73591c71fb240e86500735085d801fd1cf58a0fc0e1434b9fc9","size":341,"data":"","first_seen":"2025-04-18T14:08:11.340368Z","last_seen":"2026-05-05T08:12:47.09703Z","times_seen":234,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"a711c28060772e3dd6218cdb0b8231f3","sha1":"bc5b478ba941eb07816d1071c46530c185d56982","sha256":"43c79442348a9c02ed9b3abea1bdd7e163b160d860db0fb0c8a6c616031ea30a","sha512":"a249bd999c7bf4cb60117563f4678df035215c02eee49034318359da3b15353beccb6a1354fc3bf42a4b31503836463c5b281ea62b65123b6e2238cdca839c38","ssdeep":"768:8I2MUgcwrP3vxYb0LnSXFgPmmxS3btUpSeHcIYik4vRZaA/pkL4tDlEY2nB32:gWlfZYblXFrLqvL3UfBG","tlshash":"6733349100ea74fe1b51b1d13cf1e608b8514dfd84584e5ccbcba7aafb65ef49019a23","size":53618,"data":"","first_seen":"2026-01-12T23:33:00.342712Z","last_seen":"2026-02-05T21:22:04.190217Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"01cd239d06b2581637d9921042d1ca43","sha1":"5707cfa5edc61b9ae70db235b19c77427a10e3f3","sha256":"09a1d09bb9200f1d111e5ce3d2205e9c900aa1c88aeeb2a328323031633592c8","sha512":"891208759849c732dc9f13b98cb17c07b0de598ac42ae3c57c395d012ad6162e6c164b4edb2810ef5597fe40fdbdbfa1a6c1e73fdfc9e8027d5470c5c9ae0d5e","ssdeep":"","tlshash":"1fe02ea82ee61338237b2120831fd28037e48043a0e4f8023a1ce1cb0fd2e1000bf5db","size":294,"data":"","first_seen":"2025-04-18T14:08:11.341693Z","last_seen":"2026-05-05T08:12:47.099922Z","times_seen":334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ccff2a8eab1bd5a092a4a70cac2fa3ce","sha1":"55236db8de9a44e733170ed454b770369d469d50","sha256":"33a5f253446e9bed430e3438e284a3cfd815d8bb914c3b8d9bc0cdcfe391299c","sha512":"cb910d9a38040f9742fa2d8654232f1a7669ce200bd1dce706e085fb1269b9d2a9a8db7f13f474deca4a87731dfce5dafc295bdce5d77835b0ee37fa220d5714","ssdeep":"","tlshash":"b1e0863935761574097b987fc74b934b7da2141b5001e8167d4c914b0fa4f1034e6599","size":377,"data":"","first_seen":"2025-06-03T09:01:15.310945Z","last_seen":"2026-05-05T08:12:47.102423Z","times_seen":560,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/material-toast-1.6.7.min.js","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d0786f53c84bab5fc571c84c7da2ffd0","sha1":"244350ae0447321f0ff4c68c7f8c7c4f7cd176b7","sha256":"eb533cf5c8da6fce3ef1f6a95a8f6eb2d0669271806208a9fa55eef340f8c76d","sha512":"165f00f7683538e2a04291946fca97bd3f13270ce8d62f6d16d424b09a53f2b8b98c702f14d42ec28edf91cb03d45eba0f419f7885a56a6515d1b3d285eb269a","ssdeep":"3072:tGZLtXP8BfgQ3H/SVZzPqMnvLxJRmYhTDr8lVniazhLpvv:tGpuNgQPGmMn/vhj8jiaz/H","tlshash":"cac34bf5b753d0af02fc69979df32109a80c8924400a66bdc66ed3e56f73db48487ba1","size":129820,"data":"","first_seen":"2026-01-12T23:33:00.331258Z","last_seen":"2026-02-05T21:22:04.184844Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cryptrouter.xyz/light.7ec0a8a028ae1c0db31cf93dc6252b4f.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /light.7ec0a8a028ae1c0db31cf93dc6252b4f.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-e11\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5mWmdt1wmvz9l8DzAWqdhbRRKRXr%2Bt%2BEAC3aLtd0pYm5n7%2BlO4K3%2BgqjaNQDkcMqQJX64zyRcJEyBDL7%2B5w2UBfF85AFkvTCfhE6x%2Bw%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c6ab4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3601,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"40215bc1413bbd183611c1ded93f5252","sha1":"3d5999f62bde7bffd14de789cbb97a0111f1ec0a","sha256":"57c9c1cd78bd75a0fe843a3535968cefa529d71c1edc0cef7d2ab6d85fd4e5e8","sha512":"e8944b42f656fe66a4d88f13ae0e6f75b059495c1836381a0e81897840330af433778dbc7b1bcb1a0912e520d6573ad230b7b64ea2c1b22637c292a40b526d9b","ssdeep":"","tlshash":"8c7166e87bc2d2f8e44bdfa89a39f530626d28e72f94c89c0fc75d5498254afc0455d4","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.774442Z","times_seen":27,"resource_available":false,"data":null}},"time_used":281,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":281,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/BNB.png","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /BNB.png HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 3385\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: \"6977aa5b-d39\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zin76NSsrXhVINh7AtSQHyohBI0ve5Ft7freP6%2FDHXZXv0ZhVY0ftyaTThLfBWtJYnbTYlyNSoiVkXw1EC2hhpuufTFpKrMTEcEsmhU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c5ef7606c6eb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3385,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"7ae0bcb3e0186a2a8cac05a4ca7e0721","sha1":"bbdcae72fad4e014b4bfe44b2b3c7de19f25e796","sha256":"2ef4078da9fe7e61e02de5bcb550349e8115da8fae4b5c24fc2798ef9dd6189b","sha512":"1ff8ad76abc6d87cb81085dc6f4fec7eedd3032675c463afc6047560442437314451ea3ca85f3b2a7361c72b53cb70263450c0c7f941d185c2ace5becbb59548","ssdeep":"","tlshash":"28615c83b2319e67e17f8c4d7d761e155bd7c99060f0a12f768b8850d5a13a4bc4c2db","first_seen":"2026-01-12T23:33:00.316623Z","last_seen":"2026-06-01T13:50:14.037291Z","times_seen":19,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/material-toast-1.6.7.min.js","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /material-toast-1.6.7.min.js HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: W/\"6977aa5b-1fb66\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kzudEDXpCa5DzneMxC1fOyxIU75%2BfCMKmDEFyMpp3T6msDiAbcOQ0AbEobGM%2BvLTRDxypc7MpqdCi4szKxwT8bU%2Fcz9%2FNx0QaY9Twyw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c5ef7605c63b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":129894,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64592), with no line terminators","md5":"d0786f53c84bab5fc571c84c7da2ffd0","sha1":"244350ae0447321f0ff4c68c7f8c7c4f7cd176b7","sha256":"eb533cf5c8da6fce3ef1f6a95a8f6eb2d0669271806208a9fa55eef340f8c76d","sha512":"165f00f7683538e2a04291946fca97bd3f13270ce8d62f6d16d424b09a53f2b8b98c702f14d42ec28edf91cb03d45eba0f419f7885a56a6515d1b3d285eb269a","ssdeep":"3072:tGZLtXP8BfgQ3H/SVZzPqMnvLxJRmYhTDr8lVniazhLpvv:tGpuNgQPGmMn/vhj8jiaz/H","tlshash":"cac34bf5b753d0af02fc69979df32109a80c8924400a66bdc66ed3e56f73db48487ba1","first_seen":"2026-01-12T23:33:00.331258Z","last_seen":"2026-02-05T21:22:04.184844Z","times_seen":8,"resource_available":true,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":99,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/arrowupdown.963b18ea048ce95c19a7259914778d18.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /arrowupdown.963b18ea048ce95c19a7259914778d18.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-5b6\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vQWnIzWnLTGtPhP%2B%2BmQ0AL9oafTsiw3CWsGxdWZv294XLSvAEKAx%2FO8NGjhJAMddcxVWdCcvLyeoMdgP2%2FL%2BQOvBxbzNZFL9vVfoTyc%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c6fb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1462,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"301144b77a8bb138af7d2ea96bf4fb65","sha1":"da4f6bbce6a385301938db8f08d3224c0e204371","sha256":"7c955d727b7bb9910130c1a618477b31cdb391934f6c24ba29de04182674d2e4","sha512":"9eb83a1e20c09f945927afac063ef74211b6cd445f08704ddb8975e906ef865680b26f1e26f3f663853f621bccedac5c47d67023bab2b50b3cbb7ccf190d8af5","ssdeep":"","tlshash":"a631b9bfa3d198d1e40ce3f09124aaf8710729f2273bc7a85aa17350d1965ad841c883","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.771225Z","times_seen":27,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/doc.5cd61d709e17ebbc7a53dbf7bb4facbf.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /doc.5cd61d709e17ebbc7a53dbf7bb4facbf.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-6c8\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y3Jmp7dtirX3xPl9UKrq1PWtuaTepqD6VdyXLfUc7iQl5CZUMtFvxfPVFU%2FRh1oewB%2FAH%2FubvA4fl%2Bif397tF0h%2BOtVR7AKWD%2FjE1aY%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c71b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1736,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2d7e0160b430d7de037d9da307b80f1c","sha1":"414591152389a185d07e3bbe053ab27f879ac1fe","sha256":"d6523663460f806f26187be8fa031245fc46ee2098ff664f7bb9df857ac63f5b","sha512":"9d56c1d0a18e21382c954bac73e26a228b542f229c2f2f20d1a8549d142faf2693e9a4dc9532134b013f0fbd67fe00bda10aa6d85dd82cc81fa45dabf5872ed4","ssdeep":"","tlshash":"7e31f0fe598072f88503f751d822d0a5f7bf24b43f57458547847fc8db89110988bc81","first_seen":"2024-07-12T03:06:54Z","last_seen":"2026-06-21T03:27:27.750407Z","times_seen":27,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cbridge.celer.network/logo.png","fqdn":"cbridge.celer.network","domain":"celer.network","tld":"network"},"ip":{"addr":"63.176.8.218","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:26.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cbridge.celer.network","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Dec 2025 06:23:50 GMT","end":"Fri, 27 Mar 2026 06:23:49 GMT"},"fingerprint":{"sha1":"8A:DF:BB:47:6F:20:22:00:F4:80:17:33:26:2F:76:DC:A2:6D:9D:95","sha256":"F9:75:6B:E0:AA:50:1C:CC:4E:76:2D:E6:0D:77:3F:CB:F0:0E:5B:D0:09:F2:BA:3B:68:17:8A:0F:F7:75:5B:76"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: cbridge.celer.network\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 48077\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-type: image/png\r\ndate: Fri, 30 Jan 2026 06:38:26 GMT\r\netag: \"5a9ac0b59c0accfaa3f6c3198ffa56b5-ssl\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nx-nf-request-id: 01KG6SZPWB10V5S33WAJFD9GEY\r\ncontent-length: 7374\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":7374,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 324 x 44, 8-bit/color RGBA, non-interlaced","md5":"4749509a53d96425681a0fe61f6dae62","sha1":"4421b0a7943c829150cb68c5274c679f4b28e06e","sha256":"e2fec191251a71ac434d3ba615317bc45fc6bba7f9d06f69b0d57cf08d501319","sha512":"f4c2ac9b32c967f8d4283b8bad783f10a18a6c43f209b6f58325207fec15795ed4dfb162a31b3cb8b56c04acda02147fd0bffdad5db6259f5500e0d81e7fe103","ssdeep":"192:Vo3Ku26z8eG9kg52Wff33ZnPq5s5QSKdH0bA:Voh6hH5yW5QB3","tlshash":"afe19f55b28246cb955bb9e87f808546a0f192643ef70fdbd69ab1f9c0cc81b2b3c480","first_seen":"2023-05-20T13:31:48Z","last_seen":"2026-06-01T13:50:14.046607Z","times_seen":22,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":66,"connect":23,"send":0,"wait":31,"receive":22,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cbridge.celer.network","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/imscanExplorer.f72af6ac0c3ecd695d6420b2201638b3.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /imscanExplorer.f72af6ac0c3ecd695d6420b2201638b3.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-4e0\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fGzKwA93pw8UCR5K5A0YBBsflbzMs1KdC%2BImdibLmQRtJgGD3brz68nh7Inog%2BlO1zGFnvBfoNe9RR0T6UcJg%2B29oyNqRjt4gNTNccY%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c67b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1248,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6ba01c8370be91b532e385cb9d20db43","sha1":"e2f079095abd4ab0323f7b0278925ded116f8316","sha256":"08caa455c57e8f47482b3ad4c6a15e7c2572fd81eaac8c442fa180ebb7881ed3","sha512":"90828127aff1a7fad7d77e8c3b5137aa381ccf2fe50353e4327c53bde819cc8e4ec607aa5cad90da9fbcfc90dabf088d903b0844aefa27d8223397af63ee0a0f","ssdeep":"","tlshash":"872170f322e8a1a11d038737d5efb06b153e24f81a598984d3702994f4a59a2dfa4fc1","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.770615Z","times_seen":27,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/arrow-D.4f2bb7a1858215380034f8d4396ca904.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /arrow-D.4f2bb7a1858215380034f8d4396ca904.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-35c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KYIM%2Fd1vaDp%2FydQzgXV8yWjJsLHJRQ2GnUZb1iDPANur18X%2BGDfxNAzAr6JlSr34uU6nAx%2FdUlKuxvzYFGBsePvdx1OzQnR0uh5Aha4%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c6cb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9c904d15c81f296c97a490064b6301dc","sha1":"03db4f0af81a7f880a5d37448c0c5b66d160d3c7","sha256":"89b05e062debe5221877063995489b8c2daaa9a6ecc783ec0dec847447838bb9","sha512":"333f3a6c08ef9dd68ed22b2e207fed829a98dc14e27af0c590eb2e8736f271aae8db3b09eafd4df1f67ee3d5b68eab8c5ef398443616956e4242920d77d43b8b","ssdeep":"","tlshash":"851112e090e962f09a0def80a83bc832b55f30fb7b9e0d99d0019580b9817465d9cc65","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.757894Z","times_seen":27,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/ETH.png","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /ETH.png HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 5425\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: \"6977aa5b-1531\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q6QClQr8kXeReTOrRtukVMcFc7O0wZ8sAr4xHbw5NVQuCcVAomiF5i91zCCbi%2BeFIUKI1ZOACrw1RNTllg%2BEa9A8K5DYPjPvSqrvMJ0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c5ef7606c70b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5425,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"152c553a5d91fcfd655dd6d647d9d2b9","sha1":"231d923b594d656075a7a138401041bd93435a25","sha256":"31e45b48aa85d690b4c840f2553a907125d2e40390f892863da94fd001db7260","sha512":"83602318771131af5923341e5565afa39e746d9595aecc66cfbeba3de35b757da01342f348073403efa40812054021c612133b3a2ad563f781ebe1c5b44df249","ssdeep":"96:1k1OYLbP9LW/WJ8/SW20Wl/JCVeSD9n1nSOjA8x9MGRPQ/By2TvA7N3X:1k1PLp4WJ8/Z20WOVDLnjjNyGuyaAB","tlshash":"b8b16eac231dfa95c0997475650d2ca264387374f35a99340849bcd73be2a3dec5fc62","first_seen":"2023-05-20T13:31:47Z","last_seen":"2026-06-01T13:50:14.055314Z","times_seen":29,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/favicon.png","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:26.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 12608\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: \"6977aa5b-3140\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x6O%2BRdvi%2BRfD9f5bf21C5SrETe0Xq4csFg4w0mlxcbVHTGkBHFCL1cDBl5Kc1bBPH7CiaJjyADFVFMiDcM5XwAp7n997FSq5BM797uM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c5ef764dc93b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12608,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"6f6cefe2d26ae006a4f75ebbac617584","sha1":"64692fc0539151fc7d91269e930a6c93d4e238b9","sha256":"f54841080de005752adcb190a21631d3f7e2266b2aebe6e002575cb28b0d59ac","sha512":"a0da3faa09025d05464f7bb5b80dc7f41737f1a8f15450158aa907889e75d826b9d480fd16710ec71be0305674a27ae18e8060797fcbb75ee5407ac253cf53be","ssdeep":"192:nSGKSoB3oJy0L4+1jil+AnyxqaN/N5dFGTs72y/yAYXUNKytXBhU07FFro4OlrO:SpSoBKfL39xq+DdXVyAFzXBqtl6","tlshash":"2b42d060d98f9dd6d773da3b49700473399133905383378967b12006f2d48be7ba5e58","first_seen":"2023-05-20T13:31:48Z","last_seen":"2026-06-21T03:27:27.762637Z","times_seen":26,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/main.b5ba18cf.css","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /main.b5ba18cf.css HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: W/\"6977aa5b-59b5c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VSbJUCcHTaGU7advTrSS%2B%2BAgiSECTYnVDWte%2Fma4PfpDLmI%2FrjVw8XmilO9ogvauB29rT%2BngfvBmrm6pyuezpB6Yi%2BUk16E1DpGlEOQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c5ef7605c62b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":367452,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"7f99892c729139a734ca87064c9cf8d1","sha1":"5bfee8ce6ca1d1918abea3ee5689f92bcec768f0","sha256":"de438d1206ad1cc21c82b34226df847ab9d0d43b118d8863539f8a65b3e8c0f2","sha512":"6d6174a928ad9bf292d9eb07ccede87fe4b956540e3b505365bc0c12260eaa750027e700d088e3509e5bb5d67f223871acab44398c03891f07bd04778efea108","ssdeep":"3072:eARRw/aIog9GZrecdV6IqyuuHrW1iHjJzsDNnV:eARRrecL6IqyuuHrW1iHjJzsDNnV","tlshash":"bd74a6486f51306ee5e7c33b78a1f8659d31a603e6bfce6af2f17e588b0554901a3d02","first_seen":"2025-10-09T15:58:18.093593Z","last_seen":"2026-06-01T13:50:14.045812Z","times_seen":18,"resource_available":false,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":346,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/cbridgeLogo.f390be1a84b83fd0de9766ac8ca7ff80.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /cbridgeLogo.f390be1a84b83fd0de9766ac8ca7ff80.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-648\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4NgeZ1P7%2BOX8qoojmtw%2FgFNU0VJJmuCpbq6VUifXoiBojahUAZ73XeAJmtcurGct25vCLUNsRjz9keGkGGaXKOzBga4t12ioVbDtdnY%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7605c64b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1608,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"21bf1190ace7b69e06ca6ada8f3952da","sha1":"b2d88385a0b977367626da9f80e23e62a0229da1","sha256":"077a2d5b5e37e681befc7a477e86ade6122d66135b5788d92e06c0935ab1023a","sha512":"d4566457ffd4e7e4e0e0313624692fa6a9eadda43455d7c64a4edd772211ed33e52ae43eff6551f46ff510af7933c979ff33e20d6812ba12673326298aaa8c4c","ssdeep":"","tlshash":"3a3113fcb039a4a4fd885b965f0d68f90072d3f67208815469817a473c54d7f6d08bd9","first_seen":"2023-05-20T13:31:48Z","last_seen":"2026-06-21T03:27:27.785478Z","times_seen":27,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/setting.03b8ab0c6ed2370f1d5b530d5fd70e86.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /setting.03b8ab0c6ed2370f1d5b530d5fd70e86.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-3c1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bo84b3xKQWhfJulGfH3qns2cIHwhE23ecWEeHf0OHW5aX6l8dxTGHuxHKshmjSrpitzNMku5crfmsLrZcmDqk6QRMrLf15yPf4%2FpHiQ%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c6db4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":961,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f768429c01eab10c4076892ee531d69f","sha1":"8b710802e936b20c25a853610886e9ce1fa5dd28","sha256":"3f55c62a776df360e4e916f25e30213aab931b290453cfddda288a32d5855877","sha512":"8e546eb69c232e049bef21e2542e6bda9b3d9be4379b10b0cd3eebd7370a46471136ebd8582718f671b4f1cf47642f7153efa5b0d9eb5866a90670e86887c9bf","ssdeep":"","tlshash":"a911ead122a463e9fd0693f8a11936a0326b3cbd1d76cf1e13a11c38600387c6c9d181","first_seen":"2023-05-20T13:31:47Z","last_seen":"2026-06-21T03:27:27.775091Z","times_seen":26,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/cBridgeLight.db2c0719d5f8182ecbaec27e4155cf34.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /cBridgeLight.db2c0719d5f8182ecbaec27e4155cf34.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-19eb\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FRflxnd6f%2F1Or3abCeVmKMV9dK95Fc4fUTCHPFPKZExTTdUWnbpTh32c0YhSlr9MXkMB8RyVa7uUZnojkw7tTGWHTrI%2BZLGCSa%2FVqJA%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7605c65b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6635,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2f9f16eabc061fca43ccf76e73c6aa45","sha1":"2a8c129c85ac4ec0b3f071f63bd359139039d4c1","sha256":"ef7845ff9f572ba16beaa7192013f9000d60c16cef25002e968b3bdfcedf44a2","sha512":"9884f2f754de1c5d6447eabe0cf4febb91a0824db7c1245b1855567e417bc933e0f4b843e0f65e1b633d3a609a418b549db4f2753551ee9a23f73c5905bbee72","ssdeep":"192:2/th6eGjZI3BJDGwOo4wT067R2b1nnfIhtAfzn5S0ni:EYcxtGwOodTx7RmhQSi","tlshash":"10d195e83668a2e4f506f7b0db3669e52a5f38fcef42869083646e417c550b98c8ccc4","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.755951Z","times_seen":27,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":261,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/homehistory.d1f08632b7c418014d096d1891e715f1.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /homehistory.d1f08632b7c418014d096d1891e715f1.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-744\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aNkiQIWt4WiVohiUVfzxl9YcAnxyHg38%2B2OoZhpa8R04iggm%2FAeoau%2B%2Bwaggd40fUIZYawrVRJMhYOkIoINaLMxQvFN2%2B%2F6%2B68SooZ8%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c69b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1860,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e8c1bf850f3310d93f9a4436a4657038","sha1":"a3244f05adc16d4822b4d4cde21c22a092a2f8f6","sha256":"ad358d94f0f160ff2c6bf457222588ea3515cbb790acd856b9c19b95d1383d45","sha512":"6a6893c02b68e94703f7b24e31bf5fbe27cd1d9bd1c3d9d7d4c1d61687b56eaab7a60a00e86f5e0d0c499a3e76ed407618e8aa5ca83aac40149757b92edfcb54","ssdeep":"","tlshash":"9331e9f295c4f6b1b907b771e62b86bab83e30f5ff09cf45c2488205919902891ddea0","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.748452Z","times_seen":27,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/secureproxy?e=jscdn/getFile","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:26.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cryptrouter.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://cryptrouter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"et275pzjs9mszgsp7dso\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:26 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UndyTFnClkpMoqPFHWSbwtafnSLY5mPfZAv8xWEzT9mm%2BDu03LBJxcK%2BYSoaQrswRIDqa%2BmcU1d70TqJUjxJy8JAmzqLmUU%2BxXb%2FdQaKNl0YYQ%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef764fc94b4f1-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5667334,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e1ed3f1d464ddf1dfbc25f4510b4bf16","sha1":"a738f46ccba1ac3798bbd9e4e87c7d12fd63b4ca","sha256":"5d95922e5389581c5a352325ab5fbec32037be2bb905d377930f826791fdee96","sha512":"69beffbe6e35cfbb0d79ceeef2fe6aa8780dadd4ac36e7e3e58af8d6b9c4efd2db7b07148772d8e664dcbd668556c522bc66d0262e3b215a6009d61d252b675d","ssdeep":"24576:2/tN0GXWm9zxB7A0NSfcJFIfm/q1YhVLDLOge:INhWm9v7ARfWFIEz8","tlshash":"272512d6f211a0d37259e9f4fae25ee92d9d80aff9820773140ced6864990a453e8fc1","first_seen":"2026-01-30T06:38:56.900558Z","last_seen":"2026-01-30T06:38:56.900558Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1383,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":698,"receive":685,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/BNB1.png","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /BNB1.png HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 3385\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\netag: \"6977aa5b-d39\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wAh2KSJwmIp9P%2BbSN006LobxagMzI38exSLIr9Cy1Si0xHgWH%2B1IaAQ2%2BiL9fptQcekEoByujQMgkKVjYT2Rhj9dJCA4ms0Jzdt1uT0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c5ef7606c6bb4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3385,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"7ae0bcb3e0186a2a8cac05a4ca7e0721","sha1":"bbdcae72fad4e014b4bfe44b2b3c7de19f25e796","sha256":"2ef4078da9fe7e61e02de5bcb550349e8115da8fae4b5c24fc2798ef9dd6189b","sha512":"1ff8ad76abc6d87cb81085dc6f4fec7eedd3032675c463afc6047560442437314451ea3ca85f3b2a7361c72b53cb70263450c0c7f941d185c2ace5becbb59548","ssdeep":"","tlshash":"28615c83b2319e67e17f8c4d7d761e155bd7c99060f0a12f768b8850d5a13a4bc4c2db","first_seen":"2026-01-12T23:33:00.316623Z","last_seen":"2026-06-01T13:50:14.037291Z","times_seen":19,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-30T06:38:24.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fnh756ddENzdyjaZBVdRmB5Ti6pfbgZXo2vyJM6ZHkzbA59PnSWDlKEcmTZfdXad%2Fq0UESyYPJZFNYNLa329B%2BPj%2FgQC4MMDZF3Z%2F4Y%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c5ef75dfb9b7130-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92525,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (334)","md5":"5e9eb25930eb405cbef47045a4172daa","sha1":"4558af83d68369bedd8155cf76580880702ee8aa","sha256":"f6bc9fcdaa63dd142711dd3b5fd1ac5912cd5c4dab7e85fed269329108cfcd89","sha512":"8bb51def1b12021e241c907cd9b5124946c8da8e7b55904a64afcba75360d24d602bba5ee994adf7e2c8ea375c3c38f041c47bee2e19ed9a58b9eb39b3886f41","ssdeep":"768:+Lc0S32JNU5wk22vIjHOsnleKsYFKsYTlTYA8vtXMILDlE5VQ:+Lc0S3KN+n2cNsnl4kkQ","tlshash":"789340232bad011d2a5f93a1755a6a0fd2749013c20bdd7d76ad327cdf8dac488e3798","first_seen":"2026-01-12T23:33:00.297996Z","last_seen":"2026-02-05T21:22:04.186953Z","times_seen":8,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":67,"dns":54,"connect":1,"send":0,"wait":236,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/analytics.bf3360ba2131a70c587ff82ffcf45589.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /analytics.bf3360ba2131a70c587ff82ffcf45589.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-3d3\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TxUH1aW3nfIz8UcNC3ZkLP1GQ7vnNHXNLMea2f3Ti9iXWg3eUmofoJ2AFeS%2BivvVn5g8IBE7Vb4ovMUoyAW%2FazpPVWUvrr5%2BgnddMtM%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c66b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":979,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3afa54f9aa003134343bda23bbb98c43","sha1":"388279b3bf58b63e2105cff60308eb71220cd9b2","sha256":"2b6ffdaf739516a9d260698084eb697a61f05f3068508ecf7172bfc141dd1c8c","sha512":"035419e4dd9cd988f1b1b204ae0251be94b6b29fac1a66d3f51c438746e50fa5277807a9bb08758294a655e9681e75e33c2514882138bef8de3f83772f3066cb","ssdeep":"","tlshash":"7b119bf0578ce2498643d37a512aa1db396a70fcef9cc7c4e2626d6166a9421881c55c","first_seen":"2025-08-27T09:18:47.2252Z","last_seen":"2026-06-01T13:50:14.038954Z","times_seen":22,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cryptrouter.xyz/sgnIcon.1c9f831e2fdc1f954dce10721968de0b.svg","fqdn":"cryptrouter.xyz","domain":"cryptrouter.xyz","tld":"xyz"},"ip":{"addr":"104.21.41.114","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cryptrouter.xyz/","date":"2026-01-30T06:38:25.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cryptrouter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 17:28:29 GMT","end":"Sun, 26 Apr 2026 18:24:58 GMT"},"fingerprint":{"sha1":"71:CF:5A:6B:07:E9:8F:D6:65:6F:23:D9:3E:0B:1C:04:62:CE:3B:A0","sha256":"7E:95:50:4F:0E:B7:67:F6:70:1F:70:73:F4:CD:3C:24:CD:85:AA:69:D6:F5:D9:6C:B5:83:FB:EA:21:AF:13:E4"}}},"request":{"raw":"GET /sgnIcon.1c9f831e2fdc1f954dce10721968de0b.svg HTTP/1.1\r\nHost: cryptrouter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cryptrouter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 30 Jan 2026 06:38:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Mon, 26 Jan 2026 17:54:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"6977aa5b-4db\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h0tCbQoB9DPwYzCYWrkFtEA8RfE3XHrA%2F%2B1WLWXIooUsrj%2FHhCVWi0JmzUeORG%2FWDxnEKpxLMH%2Ft4JQiRISPQAmN5w%2B3kNydOrcjjfA%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c5ef7606c68b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1243,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"725deb9d08a984f00aa3346380ac0cfa","sha1":"e88b44d8cc73f65dd0c6a255041b359fad55ce4c","sha256":"0c37b0fd78d6770901ff02024a4b86177f9a1b5c66240d8e11e0282ef261140e","sha512":"8c290c7cadcac2467ded5cb15b9d8dd217107cd1119854e6f393de0c1c0df981db51ebb9e7c04c376bc3eca65095db723dbd4936c72d34e3eb8818f785dde667","ssdeep":"","tlshash":"0121c2e5614cf1c9d8029758890b52f7742b31e9770bc74087482e43bf691e70d07ed4","first_seen":"2024-07-12T03:06:53Z","last_seen":"2026-06-21T03:27:27.756692Z","times_seen":27,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-30","alert":"Sinkholed","trigger":"cryptrouter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}