{"report_id":"ddf5b80a-043a-4c64-9eb0-93f5fdcd9ef6","version":6,"status":"done","tags":[],"date":"2026-03-26T22:32:06Z","url":{"schema":"https","addr":"royalcash.cc/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"172.67.167.105","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"title":"RoyalCash - buy Bitcoin and sell Bitcoin","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"royalcash.cc/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"172.67.167.105","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-30T22:32:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-03-22T22:34:23.857339Z","alert_count":0,"request_count":1,"received_data":22048,"sent_data":472,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-22T22:20:05.651051Z","alert_count":0,"request_count":1,"received_data":6879,"sent_data":453,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"scriptanalyt.royalcash.cc","ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-09-04","domain_rank":0,"first_seen":"2026-03-26T22:32:09.319151Z","last_seen":"2026-03-26T22:32:09.319151Z","alert_count":12,"request_count":12,"received_data":175726,"sent_data":6337,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-03-23T02:06:33.017691Z","alert_count":0,"request_count":2,"received_data":222357,"sent_data":964,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-03-22T22:31:48.48691Z","alert_count":0,"request_count":1,"received_data":89159,"sent_data":442,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-22T22:16:16.728956Z","alert_count":0,"request_count":3,"received_data":155995,"sent_data":1703,"comment":"","tags":null,"fingerprints":null},{"fqdn":"royalcash.cc","ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-09-04","domain_rank":3224094,"first_seen":"2025-06-14T21:19:02.767343Z","last_seen":"2025-06-14T21:19:02.767343Z","alert_count":123,"request_count":123,"received_data":2019314,"sent_data":70929,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Bootstrap:4.5.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"BootstrapCDN:4.5.0","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/js/_custom.js?v=26","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"678aa29bb81d2e97d0bf70359b2126f5","sha1":"e71fffbb1cb7f20fbff68fdfb2c6b111d48aed44","sha256":"9119e0ee6a86b2949be2202ee7d40213b501c10536b8c493de39bd17509eab3c","sha512":"3713de7b562350224b7098bbbadad353a70b423e37bf44f4acc0c9e31ffe66adfb183ab83382ecc9578e0644106b2678a4876d8bb152dc73787bfe124445a602","ssdeep":"","tlshash":"9cd0a9d9210f29300abbf23abd2be20dafb2c0223001a946b80502800cfcba00037c8b","size":219,"data":"","first_seen":"2026-03-26T22:32:14.220672Z","last_seen":"2026-05-02T14:40:47.001871Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"33677da6c7fc899cd21fc7460afd77b9","sha1":"102ad0106af99bd92493b4124a5e0e682a091104","sha256":"85dde00fe39a12ad2463343c2df4f802423b4967997958db598a4f34bb31821a","sha512":"1bce5c0791d67a68cfc943aedbcf6516fa3954ae8d3c108a4ac5461e5428786153080e614b6bcffcd325ab940df413be49a80e00fde303e72cccc7b16e333e4f","ssdeep":"","tlshash":"62a024571440c177535001350f173f337c1001f450c4700040077d003100d53ccc07c0","size":76,"data":"","first_seen":"2023-03-10T00:47:56Z","last_seen":"2026-05-02T14:40:47.055641Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5fc7a9629ea473b741c529910f91c401","sha1":"a152aeab68014e1611fd8635f3f636871de8d180","sha256":"f0a264517bce8ca45011afeed4ac61702c4b6e98ff82477b4d862893881f9c61","sha512":"544b6a3a948ced288cc776dc432b19a47d59f4ff13e493937b4f60be9a7b147bd799f376a71098f9172efcabd42dc72962a62c280a06040fa7a1e59f9aaf745c","ssdeep":"","tlshash":"1911215474f23214477330281db7d8581d7a007b8c0a890d34ac06c82f18557aafabce","size":1013,"data":"","first_seen":"2026-03-26T22:32:14.273605Z","last_seen":"2026-03-26T22:32:14.273605Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/wschat/dist/client.js?v=26.1774564294","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b97824c898ac0be8a5adacfaf6fe643c","sha1":"c46b49bf98345f5278f548feaecc69bc4bac72c3","sha256":"8dc7b6257660f4799873f8b1de00702bfc08e3b146181641c752361f6d5c4855","sha512":"b96928bc802c02fce4de36483f2b226c50f423ed3fd2fa148b6e37e74ac04860b186a2cc525ed5b580fdbefffcf08e052f298921e2be9358832ed134946ca309","ssdeep":"768:X3qkjNQFEnAxMk8d69XYSDPr2a70W04A2jKirkqimSX1miBMZnHjhKTiKlJbZWnN:/ppAr849XYSuawWWrR4HdyYN","tlshash":"70535064d640f6ed77018dba3e3e59d8d8261b46908cc7d6a028fc1856c9963f0fc9bd","size":66435,"data":"","first_seen":"2026-03-26T22:32:14.174311Z","last_seen":"2026-05-02T14:40:46.886154Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/script.js","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c71f2e407f500108a2d7ded7dfb68d3d","sha1":"5c651a89d1d72ec57cc4c15c656a846a4aaee9a6","sha256":"07f6ec6b9b81b2ab5d1e9e0156dc1e24035afd93608b1fdb438c722d0599ea48","sha512":"20f31de92ae9ee064fc4c4c3433a63a09fac563105a24e71856efb6a7ba7b3f42ac4dc6d057ab31f54a812a32169d6e0967c08b920ccb59bc51d41b023bf18a5","ssdeep":"384:eMlXe3Pil/vaSmGwE8utO3KukTQDvFujrwWK3GwofwKwPoCt2vFNjOtpxudS1CQ6:b8/il/vaSmGwE8utO3KukTQDvFujrwWP","tlshash":"107219b63298ac7703dec1a6b07462417b7a5ba19c0e002cf52d7ed35588c8675fabb4","size":17228,"data":"","first_seen":"2025-08-23T16:41:30.340733Z","last_seen":"2026-06-07T19:45:25.592576Z","times_seen":256,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ac5b833fa10e2ee4e39c1c324a30b0b4","sha1":"bdec45c8b39288f57eb28b5891200f25da82f5f3","sha256":"f6399bfd61ee60194195fef6cd4f8164c9e9822b1cd4cf6f270d63cfaef1157f","sha512":"bf2440026fb6ba7547cb8ff4852c25d417098c424615e8b98f143cf8b4da7c75e146a20e49167ab7fa86829b2e54be4a104c0404b522532a1991ddd023467877","ssdeep":"","tlshash":"86114ebcfa7614514a33b0b02aff529172761827a188de04b81cc7409f986cb8963fd4","size":885,"data":"","first_seen":"2026-03-26T22:32:14.274627Z","last_seen":"2026-05-02T14:40:47.062962Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","size":88145,"data":"","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-06-08T11:38:24.524573Z","times_seen":133031,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"84415b7368fd6fc764cbe86039ce0626","sha1":"62f238e73348c77eb9e865426a7d1b7de23cbb2d","sha256":"c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060","sha512":"8423f7a626064813ea9d7ca974ac4a3d23b304717be6853cc10f356ba3a21971c531e2acf7ff0285b81897ba54bf02265c96f4dcde1bb35a350f399ba2479e17","ssdeep":"384:knMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOg3:P5sg7X/jD45eSxpOxvKD73i5vTzwL9Ti","tlshash":"c8a2b3cc3294b06643a791a7a0bf960eb2339875610e9410f199f2d97c30ef9917fd79","size":21257,"data":"","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-06-08T11:13:06.178468Z","times_seen":14798,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f93990e393e7338781a6c694f5e9255d","sha1":"32ecc543cf103075bf1341ed3e6f9d3434ef631b","sha256":"f7a6880faae2f5f39d3ce416836d20b38ab59f3d2f28b4774f594e8123886aa2","sha512":"1c953cb95f5c96e8994621896425666f2b74511a900f189a7fa060640d8049b7a27b4a4c165b475c2dce6ef61f2fe7f5a05ba82e39f859dad9f79fd2cffe6151","ssdeep":"","tlshash":"f521485df4f7121606b3b0770bffd5043a3e503b65499a08be7d02a02f9028ee487e88","size":1316,"data":"","first_seen":"2026-03-26T22:32:14.275729Z","last_seen":"2026-05-02T14:40:47.064946Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/replay.js","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"46835096cfb5871e759de48362600e56","sha1":"c656e837eafd1b4d9508618e5a3014ff3d0b1391","sha256":"f133ed85f6650eb21d4e5fa67065d995c1da84036ebb8f5bf8d4d764beb1be53","sha512":"9c1aa279ebcd65dbc4fc97352424bdb31f3cb43346cfd832d2a92ea84a61aadf0ca98b714290568368c76bdf4b460bdd156ceb0c35b3b23fdf2bcdd8e7db938a","ssdeep":"3072:fw9TErSdw8JJEiB7MiUxAYCFHLk5UbXcET7m886k:Y9TY8Jr7QxAfFHLk5UbXcEO886k","tlshash":"a4e328c931a5397367d605a8907a0241b6352955700c80b8f93dedfb78bac8321bbfbd","size":147917,"data":"","first_seen":"2025-08-26T16:38:12.262364Z","last_seen":"2026-06-05T11:34:01.17121Z","times_seen":89,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a8646729a32a47d0754d7894c8ab89d0","sha1":"c65f53dd43aef23afd13d2685feefb81cfce06af","sha256":"7abcfac2ccd93dd3d2e3868070b241537a28e2ecf0df939d3701a179d084b4b6","sha512":"f4d2658d590afb22f5a28d17e884ac274300b0fc3e1a9d96325c0ca94598ddef1c36c58be31204e6f9f759d47a676d74e1bac6b96e6432ae5d71f4dd238df255","ssdeep":"","tlshash":"8e21ce4e317a416190b7702b86af06493526b5bf820e6100bc4d64706ff1103b7b5f9b","size":1146,"data":"","first_seen":"2026-03-26T22:32:14.27726Z","last_seen":"2026-05-02T14:40:47.066467Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9c50f13ea97122a3b8b39dfd74917336","sha1":"d8bbcdfb74fb3d93857dc20dcbcca3cc4b939991","sha256":"b39ad495e671e58b7d0a1d29287d56f95755b66afe2e331921f6def911636760","sha512":"1c5d864a53f3998a8484e25e92031c02accff526505fc07b90e7c6648949be22597f013166c40d32d8af054ace8b75494e8210008fea9048aa866e6966633565","ssdeep":"","tlshash":"ae01f1a2822f6c1d03ee3c078ac0af1fbc911d860d45a61c04811fc0b2d7eb577caae6","size":814,"data":"","first_seen":"2026-03-26T22:32:14.278325Z","last_seen":"2026-03-26T22:32:14.278325Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a8646729a32a47d0754d7894c8ab89d0","sha1":"c65f53dd43aef23afd13d2685feefb81cfce06af","sha256":"7abcfac2ccd93dd3d2e3868070b241537a28e2ecf0df939d3701a179d084b4b6","sha512":"f4d2658d590afb22f5a28d17e884ac274300b0fc3e1a9d96325c0ca94598ddef1c36c58be31204e6f9f759d47a676d74e1bac6b96e6432ae5d71f4dd238df255","ssdeep":"","tlshash":"8e21ce4e317a416190b7702b86af06493526b5bf820e6100bc4d64706ff1103b7b5f9b","size":1146,"data":"","first_seen":"2026-03-26T22:32:14.27726Z","last_seen":"2026-05-02T14:40:47.066467Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6bea60c34c5db6797150610dacdc6bce","sha1":"544afefd148715da7dd52d368a414703390ca0e0","sha256":"38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff","sha512":"2394e4bad0290e39d6b97fac98b20f64d870f8b85377c5ab4217422acc421514af845c76926f197c4a4d22117d9ead389ac1e13a413c04c3818f9404d3bca130","ssdeep":"768:WLlcnSRAIvHVAYIE8Pg76Tjx4vbh3p6viDl0TS6SXH6G7e6Pxh35CCmVla4:WLl4SE0MJS36GPxhAV1","tlshash":"c743a54a7254787206df747a817b060bb3366c99a40a816cb8699ced2f7cd493277f3c","size":60174,"data":"","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-06-08T03:53:20.019451Z","times_seen":8310,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa04bb0e8fc3bf4bca57fb4b78a5f32f","sha1":"071f178266610af9b8fb6b702f6d2332535d97ef","sha256":"7fafa4142930ac9296befa317770842d07da85bcb61de4b7ae4788193f0e5cb0","sha512":"0121a5435d5ccc5ab8c90fccbe095d764736a1eebae7d60508f9aaf12aaef3e35916588b7dc57dfd2b44550c33a912466b01a00a73ed578e136b1ba080aeab40","ssdeep":"768:9AR9B9XkSqQA4uq5SEGUQEDqPLUUMjZL1iwmyu3j9NERYhP:96B5kSqj4F5SjxEUgiwmb3j9NERYhP","tlshash":"af53d69b1e8231260533b3366b5f980af63a5073c11694497c7d82906ff2c6953baff9","size":63371,"data":"","first_seen":"2023-03-10T00:47:56Z","last_seen":"2026-05-03T04:37:35.724667Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/wschat/dist/client_init.js?v=26","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d938ef0310aaa401151ba2594955c245","sha1":"dbfcd54386c9ec75a576e88e7ff16e93abc47040","sha256":"9bc01384d7e500b1e1cff7c41b6a5bc6b05c073a1d3ac19431d9c3c654c5d67d","sha512":"c4a993f23c9a56790188e78c2b8a9ed3ad86cd0030e91d62ff3dccca18a7f31e871d2b8bf9025f96a53aee79377589913f5ddee9ad4cdc42cc3b30a5a7bc7a74","ssdeep":"","tlshash":"206110a26e4c26443760baff3917bce2d874dc2934929caad0157c19b54477bd5f3a30","size":3273,"data":"","first_seen":"2026-03-26T22:32:14.269061Z","last_seen":"2026-05-02T14:40:47.012336Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"da432d3440a918d96c11c19454106056","sha1":"4ef36f43fe63235d2e06a96b66fc68ed9c6e6157","sha256":"544c01eb505c5e0f897b665d53364cacc31995cd5f36bed6ae2969c7f2091483","sha512":"cc263d839193f078efb6f08a71d9e981f3cb606bdb21c49a4022804ff70da1faf2b1aa3ded0405b9004992e901adfad5f062339e135ec5a06875957b463b6905","ssdeep":"","tlshash":"9dd0a76a65421ad086df8676724273711e770c12427fb41279fc1e446fa0e0d33f25c7","size":285,"data":"","first_seen":"2026-03-26T22:32:14.279821Z","last_seen":"2026-03-27T00:02:01.96594Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1af04e05e17597fef38f3976cb996c44","sha1":"6fb2a94658dd0b9c7334c12e52bd39cd81d6696a","sha256":"c588b6924e794fc6d34a8484b497cc36a9cc5454bb0df555aa09f3c2614f2db3","sha512":"4b7a7d7579945447f46af2b7437429703f6ec4cfb1835cee0eb565e9d5ae626850a114bc02f3c5f2681cc37395558447ff804642727672aa80541f5ede92a731","ssdeep":"","tlshash":"1a9002608c152210093325c4027a22c5f6130074b850117480c0003037a96c380d0aa0","size":57,"data":"","first_seen":"2024-01-21T12:22:28Z","last_seen":"2026-05-03T04:37:35.947519Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/select2/js/select2.full.min.js","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0a3a08dc01bbd8d727372c0a0f2b70d7","sha1":"cfe6c3a94e058178d187751846c3af1092f12336","sha256":"9b8c0a1953e5ea4dfddeb1dbd04bf03da2bf66b0542fba29bb642ecc2b9768d1","sha512":"9aaa00e3db437e21f46a4ca5f0f1091ed68da2a4496b5ed6acfb4be62c7ed2511648b9f33aebb71c6a87cbf477ba40c596c9ae9e281b7eda54e181b22e6c0b12","ssdeep":"768:6o14fnpUZnxyUsdSQmUFkrGBokOl/N8YTP1aFe7MMpQeznipGmZlnU0RyQTAGH0y:HeGnwUsdSNJkOZhfXLEGAzyqAGHZ","tlshash":"5573b848be537235427f20e6656f000a3137ab7eb00955a8b468cde86ebdd14726bf3d","size":75007,"data":"","first_seen":"2023-03-07T12:10:01Z","last_seen":"2026-06-07T09:28:12.962974Z","times_seen":370,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/javascript/?v=26\u0026h=S0JoZ0NJM29uRUhMNmJ2eG5VaTIzdy9RT3NDblpBM0R1YmtROVRTbHFmNmlhTDR6bzZjTituSldDbm1XZUZORg==","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"25ef1fa53fe4efdc3a000ecbbb456c9f","sha1":"287e2583b8aed94b7147c900b792c45553a9b687","sha256":"4a2d78c9751ddc6beb683bf406b68dabcb046ae4e6df544330f8baa8c1e1a4dc","sha512":"fefe52e50a6ea2d38ae375dfc8cf671f860e7c94c58b6881a035cbf3960deeedfc23425e9b20b922580450a3337444ad5d81eacda99fd61ab071a95396ceaecb","ssdeep":"1536:xs5E+aIGCsriNKowg+HaXcWB03YIg/cIgC8Zr4BWQyRcE:xseIGCsEwgaaMl3YIg/cIgC8ZrFcE","tlshash":"5cb372cd3992212546b3b33a8fbb8908ff3a952b055517197d8c95913fb081893e6fac","size":113389,"data":"","first_seen":"2026-03-26T22:32:14.212007Z","last_seen":"2026-03-26T22:32:14.212007Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"94110f4f2f762a0efaf7cd1f002c3b3e","sha1":"e51089c0d4db14a98a423fc01b4af3537431aae2","sha256":"18cb6952135ec05b02d1fc9a394ff4d2c17b4c7e9c90e9f3f9de3f2bbe39ca00","sha512":"9a3a035d927bfc68ed79bef2c56a8d9f1ba511e9bbc9bfdb82fab2c062bd190ada4f5a0fa2302aeae8930cac00a3cd10f3a37f09fe8cb906dabc66279b2c907c","ssdeep":"96:inSV///awFOUHPBFU5N7ZrFijzs8IYNvU+a1L:ik//LUU41rF1iNM+aF","tlshash":"fd91fc9e35a750a13ff3a1bb057b10a46637544faa474d1037df87542f88b20bab3608","size":4223,"data":"","first_seen":"2025-10-11T00:55:53.88413Z","last_seen":"2026-05-03T04:37:35.99103Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"0c4a1b23ffad1e1a963f6ca52ea11114","sha1":"23be91ca6c63a94cc7694ca21b7eb218ed3a7626","sha256":"281d75c1d31721f81e2eae2eeb7fddd94b2df237c0dff3a750893bef4d7d6ed8","sha512":"dd10d516a5aa1eb92c25f52a2a7c4f75e0b4a70af25a40995ca94ba3d54427bd9029651afd13de5a1657a0c973a4cca2d05cf669a6a4465bc254f02e47b2aace","ssdeep":"","tlshash":"ef4100c0c022e080e00022b28228002080c8ca00c20c0200800000000a0082800080ab","size":2205,"data":"","first_seen":"2025-12-02T11:34:13.23417Z","last_seen":"2026-04-03T17:28:07.161398Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-solana.png?v=2","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.068Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-solana.png?v=2 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 19658\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-4cca\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fe0qXztNVi4rgn%2BygAOdN5wHCL9ET7XVAcP9YkIFVPcf3n36hg0JGf0SOnH%2BokKEtAhU8GnJCLhe%2BDylfFhax%2FTjqV7O%2Fyo0A35SJdrSU3P%2B0yClI7sew3Q46zYLoV8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b351da15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19658,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 442 x 442, 8-bit/color RGBA, non-interlaced","md5":"bf1259e4e32b863d3aa002e095c51353","sha1":"e66c7f890ffcf4fe77257818695e504a2a6859e5","sha256":"87b27be057eddee390d9009885978975c4d055caedff93eb12a49b01b1cf2c56","sha512":"310193e54e8d448e2cab53377c56467770c61b908b4b620b0221ca43ec038dc4d7cf6892837395912906bc92d2dea92267bce1eaa3e4fa2ae5dd68f89d1ced4e","ssdeep":"384:jGoO8O6zyH6K1BgBXPgF/IxCiI35O9cmk7bTSqUWURyGER6u9Vdo:CoO8OzRBglPW/IxCVJ5mk7/aRyGo6uto","tlshash":"9292d0cd9f6d2f45fa76acfbb10379845473e61a3d6f132031594e98a7c004b21a7e80","first_seen":"2023-05-06T12:03:53Z","last_seen":"2026-05-02T14:40:46.915553Z","times_seen":35,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/popper.js@1.16.0/dist/umd/popper.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 1.16.0\r\nx-jsd-version-type: version\r\netag: W/\"5309-YvI45zNIx3656GVCan0bfeI8uy0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\nage: 3022671\r\nx-served-by: cache-fra-eddf8230073-FRA, cache-hel1410032-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 7684\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21257,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21084)","md5":"84415b7368fd6fc764cbe86039ce0626","sha1":"62f238e73348c77eb9e865426a7d1b7de23cbb2d","sha256":"c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060","sha512":"8423f7a626064813ea9d7ca974ac4a3d23b304717be6853cc10f356ba3a21971c531e2acf7ff0285b81897ba54bf02265c96f4dcde1bb35a350f399ba2479e17","ssdeep":"384:knMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOg3:P5sg7X/jD45eSxpOxvKD73i5vTzwL9Ti","tlshash":"c8a2b3cc3294b06643a791a7a0bf960eb2339875610e9410f199f2d97c30ef9917fd79","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-06-08T11:13:06.178468Z","times_seen":14798,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":1,"connect":28,"send":0,"wait":27,"receive":1,"ssl":57},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Open+Sans\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"63:D1:AE:99:1E:49:D7:6C:71:F3:BA:F5:BA:47:74:1E:EB:90:E7:D6","sha256":"69:90:BB:9D:82:60:82:88:FF:CE:F6:B3:3D:DD:B5:B5:FB:F0:56:17:FD:FA:0D:BC:9C:5B:83:51:98:0D:2F:CF"}}},"request":{"raw":"GET /css?family=Open+Sans\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 26 Mar 2026 22:31:34 GMT\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6193,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"7e0a00a3f6ab7ec04a66dfa361b7e9cc","sha1":"99de190ea3c393de80111d132e58abc20f988664","sha256":"64c18f81af81ab6b2ebc8598ed900f7023e0e8788bedd348ab41a92d76f80655","sha512":"6ed19e94e0438c18bf2c2ced27f712d94ecc74391b5239d12e2f300bee21cd9879377577e3cb86f385fafb469e93351e671af17d8bfd3e2231c0202909406a90","ssdeep":"96:ZOEba9JOEbaWDFZ8OEbajkOEbaFYOEbahOEbaNy+aZjzBrWOEbazubqGIFuV4UOM:a9KkjzFXCNqJCbqGIwV4jRlYx","tlshash":"9bd11f9000175050ab471ce627cebf34ee1fa2616040d07aabfd478aeddbda5637931d","first_seen":"2025-09-17T04:21:06.438819Z","last_seen":"2026-06-08T11:44:30.650757Z","times_seen":11037,"resource_available":false,"data":null}},"time_used":1012,"timings":{"blocked":440,"dns":3,"connect":23,"send":0,"wait":34,"receive":0,"ssl":509},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/zcash.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/zcash.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-59c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ryJ0P5N21s0Pu%2FcxV%2FIFtIDDRJiW8hRQjhHhWMFlOqfGLB2KDbEhCl23MC2OuSEWpy8R7pnvj%2FQ2q3ZzgVxiytxFOezidKOmVIB1G7c%2FQHZ7Tem8r4N6TtgQi3gd%2B3U%3D\"}]}\r\ncf-ray: 9e299b351d9d5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1436,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cea448479da363631e914b5a0ffa3106","sha1":"63aee7c320ce641390440fedd6482d73dc096ed3","sha256":"46c9202a5a936b7b8387699ae6d2cd04d1818092c6902b3b1b2f37eeeba6e135","sha512":"ac3d74fa6c153105a1d996cbb02256bedc2ccf9078266abaa8c9991ba0a7992af6eeb02522386e50cfac14239aee08ce3a7d4ee237e63b45029588952b96e1da","ssdeep":"","tlshash":"bf21541581468d2ba2fca394eefc4dd9ba70c65b013a45cc7e57561bcf117b2402b768","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.963866Z","times_seen":10,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-mtsbank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-mtsbank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1157\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-485\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JZ4mUBSSPvk2gJhqCmejrSKNaP5FBuPb8sPG1tg%2FpNr7cqtDBcq0XTfeOB%2BW1vDtRT%2BvRx2Rs996iTvrNwNZoiONnMXmYJ7%2F9Ej7qHAIBFtNnnrTfN3AbMvWhXOTPq4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b359dcd5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1157,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 193 x 192, 8-bit colormap, non-interlaced","md5":"c721f23f872ece1149e1e39cd9e845dd","sha1":"01a6e64660f8b97d441961adbe1923c2d4b3a716","sha256":"3830e63ffb49f77270cc560f83e48da5ab2c8870530ad28b5ddf733f378459b1","sha512":"9321547f70878d4e48e4d7fd3fe645fc544c18b35a00133a856d8143e045075cd19b9aeadb8fa02a90591f9699abf9b65711f8ae09ab65b4f2cd2990141b2c9a","ssdeep":"","tlshash":"8a21d7cae63cc885c2035d91bbca14c86bc78c70150a0f952287f114bfb02ee1b76352","first_seen":"2025-06-16T08:35:34.371498Z","last_seen":"2026-05-02T14:40:46.972208Z","times_seen":14,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/bg.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/bg.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2195\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-893\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F9xqzfm5%2FoQrS3V0Zk9FSUjo8U%2BMthqAnFzwdC3iiCkERQ9E6eFqsS6pD57EnZush520wpZffmFUeLExHdlQPAjYHpzqFo7MLJAmFtU5YGp55Ks1SeCzbshCIV%2Bk%2BhQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd815fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2195,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 331, 8-bit/color RGBA, non-interlaced","md5":"52b8ce3c5433515acabd1ecf67bb60ff","sha1":"e7eca703069dd664742a632775fede11e4138d8a","sha256":"de6b6cbd47d4475dcd9f29cdc5f4cac86746c61bc6fc7dbe6f2951b85658b910","sha512":"b616eb9499b0ac50b2ae5032eaf5faa9af9f43b8a884af9f309ee4e5e65770cfb01cf91a5bc523b41ce36f13e5fa2548e3fa1a777d756234135c60d3d88197b9","ssdeep":"","tlshash":"1741b189514951c352784a4125d9e50a43a302b07bbaf739f875ccfd751b3be8347bc9","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.96325Z","times_seen":38,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-algorand.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-algorand.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2447\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-98f\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PNonstHOYbBalis4iIhjEDq01%2Fiy3kC5LikojHav%2FqPGEd89JgmHbVIm9lIKCVisTIau3AaoQHee7clRXm4QAfVPZqZB3HxdjCOcE1y4jcbZe4ZBiIcMChPhhKlgfEE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b352da45fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2447,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"449c61cf1229c4ce63486482b5ed3f57","sha1":"15ba266ac23638ec54d86e1b4fa0c7e1e4a247ca","sha256":"e1cb92d5abf3037443dba68d2a80505ce5b9be5b6dfb40f2b47023768777cb39","sha512":"722641f5c2cd1d3489c2acbcd6e3d58f21d575b31dd292a2d79f458b82eca9297a7787f556f1c8105973b52a959fb8490dc9b23e07cd4d28a102a4a048b4f089","ssdeep":"","tlshash":"b151faade41c0b91daa22dcb4115cc51518075b22e937f9586bfc8aaf1754fc2a4ccd0","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-06-06T16:45:30.803095Z","times_seen":43,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/bnb.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/bnb.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-6ba\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pXwoqGnOaw99sSbaazWNzE3xTUZvckXNSGocbjlycrkcA3SGCMbma04MiS7eP19Ncu2yUu2W513bn8G1ia5MZjfDftA8QC9tRD1%2F9jxX9jjcj49fN4zuQ6gCDOD2JHk%3D\"}]}\r\ncf-ray: 9e299b351d9f5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1722,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"90cf21a99377c0c4c42ade50647c2571","sha1":"3615789dd6c8afa7a3d80b4e2e79e4534075cb45","sha256":"42e124c0e270067a3409f29587ce2b1a3d2388cfaa17df004a1013f6a6eaeb78","sha512":"4eaa26f0dd141779926a35906f9ade7741ef00c5ab3a338dc216832e7f57bc87599ce6c0184d9951df006fb93d63882ceb6709e2bceb96a29ce7aa66b1fab350","ssdeep":"","tlshash":"6b31d2c27559953ce82b039ccfe2b9a80a2df5cb4ff13924e7d916974d3a0d9866d408","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.900825Z","times_seen":12,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-piastrix.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-piastrix.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 10154\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-27aa\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8prv1y2DcdqHQATOjfFDWjP7lro7eimCnUjHm2TdbAritFQMHvXB%2B983jmeTZMpSQnQlJ3UDZUZ58EULeOwqZlEua2gyXM2ug07PvE5bASHDDnPVm5chsPS3HhvfTRI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db35fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10154,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"b8674422c6f47d0d94b9ff15b6a8d07d","sha1":"9e589951d92ff4fee7308601568c5618dccfb310","sha256":"ef0cdc43ed77c1646f779d5be927c691faad0fe01ad9db5cc237323be6e955b9","sha512":"4ca93340057a0bb79b0fa84027ec3542b2d291ddae9fb279606108ea81fb7121553adba918cad023613cb3b9eac619e7c159caa2e294f27a84d763711a836971","ssdeep":"192:KO1XTFAU0SgByk/N/TmXAEWC7RrzudAbLemXNuLrAr7dFB:KQXGU0vBys7DEWC72AbLCornB","tlshash":"d522ae76643a6c0410ed5b3c925e9ee5a2e1756ce2aa0eb82bec7410f7ce0283659749","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.972898Z","times_seen":14,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-uni.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-uni.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4286\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-10be\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yREveL9ONfqzCklG8LUWDb8l1aCddTmoxn4pOt12uSHvDEkEOsyyU3DU5oMn8oWYzCEPYo7tWj%2FSsuCK4hGBDFuH94ajsaGBrdDuLQ63%2FoADlfJtQn1qJfuC6maozGg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b350d945fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"24c244a9b134b0b20dc773ff3205ceff","sha1":"4cc2e56268b05b16e8f83994d123b718dbd9aed2","sha256":"965d190fded64a36997b47c11a127aa66fdfa182642f24ba11d1271674142a74","sha512":"66e2c72c9479ae0c4a36f6d8a1a5074f2ffc484fd39bb7a19bd84def584071affe5dd95f960462a713b873042a18302ea921c319d9e177aec1cfbc8d99e87607","ssdeep":"96:qnaFq4eHDfniUwYKYmtTTbnTJXZiTvTYZb51oQpuz:qnaFq4eDfnIYmlTJZuet1puz","tlshash":"74917da5179858b86680474fdfe543cf4f932db31000552f2f90f59a6b38f7a5248cb8","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-06-08T09:03:19.627198Z","times_seen":300,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-pix.webp","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-pix.webp HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/webp\r\ncontent-length: 17198\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-432e\"\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oEup9WOxauXe18c8gtgw1y8SP6%2Fop9Q69dnxsgAl6mGyuvYwREPhZd9z0IpyjErB414V%2B5yotuwmlD91YoF%2BnJjNiI6grvIRea3RML%2FLXY%2BQI0OH3klzSXOHroMtzYg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db95fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17198,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"48a5392cb9858758d5db2396bc5c26dd","sha1":"d69cffd2048201b3dca0c85f95553ca16a79cdf8","sha256":"7816e0d79fb617c4078999351eb63f4657c5b3889177d9097af45e14770efa07","sha512":"3c3eac701d7acc37a631e2b8911f96933ac583b759dccf336e9e3ca5e714273e0168728f58906946104427f975e3c97f5487a2b4235f5e57c8d32ea21de4caa3","ssdeep":"384:YWccnZlGmEMEL1f/BTH+zZVJHFei3+Et6VN84BlNjOGcaIGZgkqhPED2nl7G:BccnZlDkp1EGBlNj3TZgkqJEp","tlshash":"3e72bff35074bf11e29eabfa5e6fce79939224061ce1caef1409c6548c04e16b5d29e8","first_seen":"2026-03-26T22:32:14.108738Z","last_seen":"2026-05-02T14:40:46.90734Z","times_seen":3,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-tbank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-tbank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3637\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-e35\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CXJTkPNYsKyoNkLUoo1acsTrYUPv%2FCLfSq9aBlIVgdNGewIw1%2BVBglPP5Zu6jTTNECrHJxAU1knvceiLB7P6rYL3VUc5up%2BKWqxJi0Wr777O9%2Fb1Dzeey8oJ%2FNYzfBg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b358dc15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3637,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"8ca77b20e82473edfc7af4e4637a1810","sha1":"9cea1918a764997cd9fe3edb58326880b24e762b","sha256":"622ef79f58ee984ac10f2ffaf88ab926dced4ff9c7b3e573fd530fe7e610781c","sha512":"4c73f9117954fff4cd50bcde7a39d55a82449528516a81c0ca732d00f7d5a6e4f4fda29bb915316ca6a1e07bfb1c45aea5d35925200fbed50851204cd91df877","ssdeep":"","tlshash":"fe717e4f4851271c9750c7b234bc126b0ade1d2adfc04e79b90cc8bd755baf90544b9d","first_seen":"2025-06-16T08:35:34.411895Z","last_seen":"2026-05-02T14:40:46.966859Z","times_seen":16,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"royalcash.cc/wschat/stream/?wschatid=3447729899de617af2d67451858a285b94490","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"172.67.167.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /wschat/stream/?wschatid=3447729899de617af2d67451858a285b94490 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://royalcash.cc\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: cCZE/fVBBBpI90iLxyluyg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocol\r\nDate: Thu, 26 Mar 2026 22:31:35 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: muvBeqt+vzjbT67khJII2CX/Zs0=\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=HR%2BzA2HB94iDge6wQKCogIaPwe3jPuK8BXsvQECdsAjtGZBy%2BSdT1k0Yg%2Fwc5gHAzI9g7UjMb1rdYG%2F8ZMwkEyQcCWq%2FHvgCyXoQCRormKq5z%2FKsK2wPS0blCJHmWtw%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9e299b3e7eef56c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=621\u0026min_rtt=614\u0026rtt_var=141\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3188\u0026recv_bytes=1488\u0026delivery_rate=6787500\u0026cwnd=53\u0026unsent_bytes=0\u0026cid=f78c4a21c6e9d114\u0026ts=192\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocol","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":0,"dns":1,"connect":1,"send":0,"wait":180,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-bitcoin_abc.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-bitcoin_abc.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2382\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-94e\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=anNKutr1UcFECl7UKM%2BBCRY7JLhtjBeM0id3p5s0k1O2dQOkdWIFyAUBFEgMXuj6URBrHKDJovcKwxTK3FYstalj96ZYXlxpdIvhAFGEa%2BYlQh1wzBYexdHhBZs8ef4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b351d9b5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2382,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"c2a569c32718bb31e5e000c2b3e8d8df","sha1":"a877c99a07628a222c4308cb97f07a62a3b69b7d","sha256":"17482ff03076e457437208f1ff47b8f4a4b5c7609628bb0ab430c547807964a1","sha512":"d950203f7d3b7c726cbcf4e80708fce66ec9943e83a78dff4e8faeacc22810e9d2e1703d9370feb78c1bb1a8ea4782bb95a4d066f7c4d7b715d60a59fc093bd2","ssdeep":"","tlshash":"ab410a52a7412760dc8cf62392f1712bcd6747d475d2e9a23ccacd7b41300ba941e5d7","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.944556Z","times_seen":13,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/mobile_russia.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/mobile_russia.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-60e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LB1lSTpYC9yji5zek0KpfLsuBFBqXRCMUVwYab1KTLlN58EIq%2BQoxWFZDR3%2FkQBkKL6X9fKdVpM9iTQELroM5eZURNCRE%2FAdA0ee4t1%2B0vFJeaKz3wKCOtwK2M2k%2Fxk%3D\"}]}\r\ncf-ray: 9e299b355dad5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1550,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"29763041bbf079a9c3dd8ee12c73bd0d","sha1":"8af2ea6ff15acfa689dfbc57573c464d4552c691","sha256":"0cece003845289beb24a7f6cee34ce2610e0c9ec7d6e3561513b184647000d84","sha512":"e0cb3a0c5c3f15df453ab70b5b90e5e16d6e8d82c88278825fd5f3bdaa3965a216a4f5413351cdb1d8ee75335024dea78ad0b65e68785a7a80dfc30941e11731","ssdeep":"","tlshash":"09314258a195443e82a8c260fef45f45872da04772c75cccf4dd2967d5212e1f307ed9","first_seen":"2023-05-08T12:10:57Z","last_seen":"2026-05-02T14:40:46.868685Z","times_seen":6,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:40.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:42 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qu%2B1etREhdraP4oJxX96Y9jNiYd1qCoLuJzKj0WL6C0mhZ7g5RNLSpE4NEvdeImQv2MStdAOA1%2B%2FLkeUFZn%2BohokF7lRqzoeFDAtnpIbqjP99YP0AbcnflxY2ZOGtqVLtJILH5FwONq1VEz2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b5e0ff15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":1678,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1676,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/es.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/es.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 22710\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-58b6\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FOCQ4dEnCAulFLEZqvJVXEMKMgztg1x9i5LiycYcmFmpE8c4dLrS%2BbNRVjGtbMvD%2BUm53EIAFM5yONstYdHCjCb2ekv0a0R3Ud3cHJTuUp4wjDBLCBT%2BF4jEx1FZtSM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd7f5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22710,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 367, 8-bit/color RGBA, non-interlaced","md5":"6b03e3c7eb13e6cf8f8ee81d51643422","sha1":"6831673fa4de3aced965aac64e30b9a91c0c5bb4","sha256":"a3449db0784ad4600a4c7c6dce6dc1378188220d6815e22249fb72135554f631","sha512":"570fc2ff9fb916c3c132164ff09997a818b8648e64db326c9f6593a8818a2a82e50b7e230b57fa54b02bb3b8bc8a47fa40880fd68a619a40c16876db2a6e6714","ssdeep":"384:G8ytpdlU+wk01vroBTy+Q0SgYAB8ltv6muGBUFyEzyoa6oSZ:mtpdTCv0JQYY88lUQBUFzyT6xZ","tlshash":"f5a2c056d69254df6032b3c6b162aead2b3cc678cd202f148413c6aa7ef3b8187c9350","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-05T20:47:16.749605Z","times_seen":40,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":132,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-ozon-bank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-ozon-bank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3467\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-d8b\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H7vDLDQIaio%2BtNS8NpARCa0nRGB90xFFjwMc50UTU8ronxnfzt9LnVAqPYjenrEbU4e0whD4xQ1mJgtwBNqQyZFznV1k18H%2BU3Qzz1U%2BZfKbTblwlJ2VafFMvphHpyc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b358dc55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3467,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"56c0fc3e01156811635f825bbe8c7924","sha1":"b0ec42159ee7dda8ce6e011eeaea64782492e0de","sha256":"3cf5319c3b5a15c20688539f16893aa7a2b9b3a71817f609e69ca0bce3505fcf","sha512":"01ddffa58d00e80b2ce92cb8be650f4fe92210e300b05c37d8c1ab783a8f18c6a11e3134abb88e0c09c7d320ba40b6f0a91272348d0c0fb5b3379d5e0a74ac4f","ssdeep":"","tlshash":"066109e33481dec4e1e277783de979d01ac2057db4181df1595a746f23377a44a48282","first_seen":"2024-03-07T07:34:52Z","last_seen":"2026-05-02T14:40:46.95235Z","times_seen":17,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/akbarsbank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/akbarsbank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-445\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T1bjUCg7PWQJxE6rVkRkVCwgre9gSirSebhgzwVN%2Bi%2Byb4iH%2BdKbc1bohy3mdq5C2BK7rwpcG6KJW1rtob4bsqKjbocWDO42%2FBDAnuF2%2BDUlsm%2Ba2ZMXpLIUwfiL76o%3D\"}]}\r\ncf-ray: 9e299b35adcf5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1093,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4f0c649524188c0e71df8c90aa4529f4","sha1":"b4c21540d1c323981159f76022e26b328c6345ac","sha256":"438a6b66867c383d9d60121b0a9c5e7b23c7d0b21b0e6060d264a8c68a3f9d9d","sha512":"4ab39ae65c8466b719ee3d9ae85844d92cd8f021c34834f638c216b56b645859efe301ba33ba5542dc5edc6b657a0447b788b409479ae2945c70b7d7ea7d9ac9","ssdeep":"","tlshash":"3f11232895da502f81fd02a1fffd67c09779e05f0126298cf58a24638e17e719a07f28","first_seen":"2023-11-22T12:22:59Z","last_seen":"2026-05-02T14:40:46.895416Z","times_seen":5,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/flags/kgs.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/flags/kgs.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 762\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-2fa\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lH3e9ko67pyCcz95Kbgje9wYKNTlMKj3E57fzFf6lxU1toWlu3TOEnHQENb3d%2FE3b7IianqPq%2FXW47od3DYG%2FhygV%2BXRh2wO4th9kdJcWFGD3cbly%2BtI6l3XQht66d4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdda5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b27d1de9093ee571512ca477ce02d60c","sha1":"bc28b73b1c6b0cbfecfacb07a1b10984a491d8f4","sha256":"3e43f6179a5b1ae3e929c23aae1d538194c92f7f77042604d544cda497fdacc8","sha512":"a82835751fb54de74bc3913b4df5797e0e82e22d3ea0bbcdf58a15a61f760f04993a6caf4eb61604e57fcc8bd97172d0e3084e539eab1d1becc5c3da57af629b","ssdeep":"","tlshash":"060125c7c4d22137c54405ea1966f82a55effde8449b5ebe1557dcdb04403865494353","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.976646Z","times_seen":16,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/telegram.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/telegram.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e416f-4f1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r4%2FlPTqrg0nUXCbQBG4TZE0cdpSI4Xx683ul0g22kO3cG%2BMzWcImCAdfbVoAYhc8gLntjXRE%2FxO8YUJpMNAj7QSb5dfcqvifGyKuy%2FchWp4Lvif5j2riKI%2Fuf6Vpm1k%3D\"}]}\r\ncf-ray: 9e299b39bdff5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1265,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6aec2dafe020bfed18aa556f8e34c7f4","sha1":"1aa0d4a3b2a8d5803f804ffb82a2d64faa99536b","sha256":"3368db54e152a72e8e6f580b099c85274b267e49d9afe24f4e0b6d636e7ebedc","sha512":"4a987fcd6326a364834938ede3340f67f724d1f1589d7fda576da7ceef5d7bc2bfce52f376eb0220794fecdfea99d6787cee3d90f9f89895c73b4740bae6912f","ssdeep":"","tlshash":"eb2102e811fc09dc6026a74cb392d4858bdce0d7b3218046334eaf3a4f26c50f61b120","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.918531Z","times_seen":4,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/ru.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/ru.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 603\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-25b\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=enl%2FtpTdUlK%2BwAfTN9cIi2zCwtnRu8p0%2Flm2kENObhUogAC%2BDA0urGw4lc5ck2HNUIteyF8FWK%2F44a9VKRhN7OCsRE0uHqqlAIxmexnwXkV5K2ufVZizhRTiGgF1Xdo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd7b5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":603,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 367, 4-bit colormap, non-interlaced","md5":"451302416ac873bd00b3adbac25154a2","sha1":"c7457f5e1c9993c4fb2ef59ee475c56cb5b75b27","sha256":"8c99b74912ee4a5933e95857fd54a43bc5fb5b386ca604d3f250c60ba7eb985a","sha512":"d15d941eda8ea717cabe0a6fbf5b9cb00c2a30fd88dbb48d7f99f7e51389397ad6c68b4677a667a2106c410b802727c8a08a2ef82d4a0ade4b5857f7f2cac9bb","ssdeep":"","tlshash":"e2f06d9211d8dbc0808e303e2f8e70b30b1b17803957960b032ebc40bb6f6335a9e9c1","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-05T20:47:16.723559Z","times_seen":42,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/monero.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/monero.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-958\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PV4Zj6ctpS32ltPH74JNn5jFBA0%2FujcvwMjwTLxAMQZLElu%2F1%2Fhe2UDeMvXgJD4aeCXy7uh66rx4XuR1Za5LLHQ%2BNHpagttvJm%2BE4WtAfLgXQYid2qZxQLSH2ITh8cY%3D\"}]}\r\ncf-ray: 9e299b34fd8d5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2392,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"de6f3727b783d96c52b7ba8e03992cb4","sha1":"193d7869c929e9996ca8ef5bc181ba04973d7c05","sha256":"2447d2dab011559d1fdd3e39e47886f83b6d38377f19a3222bece5a8af000366","sha512":"daca5f19b9c4e7edb264ed5d87b0612284e748f0860bd3d025ec0d849ab7609ac998a55c85fdeac2a321e76cfed0866979cbe78e493f7a846e99760bf35fef71","ssdeep":"","tlshash":"df41542db7c09c39921e63b754fd08c1f96e119f82d76f84a5a47c038a23d38982f56c","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.962177Z","times_seen":10,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-26T22:31:33.434Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /en/ HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 26 Mar 2026 22:31:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nset-cookie: http_refer_id=23179474556584; expires=Sat, 25 Apr 2026 22:31:33 GMT; Max-Age=2592000; path=/; secure; HttpOnly\nfavorite=169%3A171%3A; expires=Sat, 25 Apr 2026 22:31:33 GMT; Max-Age=2592000; path=/; secure; HttpOnly\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D7TtejrJaN1Ol1HBAIH8MIL8x3QiBQWT2cfKt8pbq%2BrXlxqK9FWq2kUn0UOyaQhIvWKK9eZnYLkApZcrkCUz3UgPCa0u1rUD1WUG9n7DgjsXegJBT3rLWTtpGf4nDQc%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9e299b31ff44b4fd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap:4.5.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"BootstrapCDN:4.5.0","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]}],"data":{"size":129657,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (533), with CRLF line terminators","md5":"fc762abef8c41a2596a00947f5941e50","sha1":"e917e51c503a80cde7c93dab0cb4b9e68e169374","sha256":"681931750feefa7e3b38811570a1fcde30d7119f1e512612c080d4978d2648f5","sha512":"46604ec62c42c5b03f84fe0820c572cff5be173708e71f698a33018f48fbf7b0639089268957cdda853f60c5a4448e575785c811f0025b04748cad1698c0364f","ssdeep":"768:1IiM4J+b1MgW9/gIUJIZ/nTMgW9/gIUJIZ/bp9HNwa1mZ/Js:1pFo1MbZ/TMbZzrNwa1gO","tlshash":"31c3be1061e608b3c47350c255689f8eb1a5e347d3034f8576dd3ae7afb2d609e9bc2a","first_seen":"2026-03-26T22:32:14.132816Z","last_seen":"2026-03-26T22:32:14.132816Z","times_seen":1,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/flags/cny.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/flags/cny.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1051\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-41b\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cGIytUkoSoLIvyuqZVpIV0a5q7besUZi2vRPZWkQNHWlsVPX2x27d3gZOVN35H4AAoGfjaIPiadbar0sJ%2FSAHFa73eWL3Zpvl3ZhlTdQzYbKVAMb9NRI59DBg92prwY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b357dba5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1051,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"c755c1ad80273eb1800a007c4cfd7b85","sha1":"12f0da00ac6f17fa5ce89a6481fea13715d0de81","sha256":"f05c8f1a53d2c08668237b057bcaa3f069481fb51210c32762f81ae20ade4f4a","sha512":"881af1ec11fd2c9d66b3f8f7d1e704a18cddbf0d550efc806b31b180c727de4b5864a87b62bd632eab673c4b7e8689758437139c3bd89670daf215f576971dee","ssdeep":"","tlshash":"ac117209fa2438019588a49138f6901b9d2e288086edf47ba9dec81a4cf61f250397c7","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.917335Z","times_seen":14,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/openbank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/openbank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-de5\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cjOpBkg4%2BAPw%2FpSlbX%2FVvTrt0q7YEC7SWLLI7iDgmNXaoNv5XZLu0zulXo07ojH%2Fw9NpFxeiOtIL41CdhBUFzqpsDNYnXQqhjF8KlNVKTsSz4kGTfBsGQr7XUHW0NvY%3D\"}]}\r\ncf-ray: 9e299b359dc85fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3557,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e4322774ae745a3221b2c5aed5b18398","sha1":"4a98d59aa034ad77604aef488b0ad66c1205769e","sha256":"69874fbfe3fd9645589f6987362442d79607edcf02cffb75b683fbb2d1e74114","sha512":"b85e5a02f3489fb2b761710ffda4d192f84acbeb45f2c30e957a6be83a3f9e0ea306f36648076b1cc76e762e6c007adf989ee133a0a15ebb9570abd03b222eb4","ssdeep":"","tlshash":"227141fd87c884b0ba1e336de8e74ce3358321e76ae144dc66ea6802c767dd11f19589","first_seen":"2023-05-08T12:10:53Z","last_seen":"2026-05-02T14:40:46.879715Z","times_seen":10,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:45.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 502 Bad Gateway\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Thu, 26 Mar 2026 22:31:47 GMT\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 6453\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9e299b7eb90e5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":2238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2237,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/bitcoin.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/bitcoin.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-9e4\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bm1YibKpzwn1snPjxyqQ2FBH627517xuKOZoNb2PajJpUKxMVr25FYbWOXwZJ72psyFLCTTN3NHMHeolcMnDzyrK09KA8i2nS7XeAf%2B46jDtxNzNoimUiINiIfvjekw%3D\"}]}\r\ncf-ray: 9e299b34ed885fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2532,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"74be5cfa486f6beab561a94631996dd3","sha1":"0e20600275957f27ef511a7425e63d2bc7b23c4e","sha256":"b32c638e3d8c50352b0005f3a4da0c1cde7af44c3445250872728f10051b4384","sha512":"548a15250db461e3a78b3dab15154acb8bc3674a9205ca7db4ac1fe114c4822481a1b236779d6de9def9f1cb1300b7bf572e6b5697b7c49487a557632b2cda9e","ssdeep":"","tlshash":"4d515ff897d982e0b28dab60d97d29ea9714307b76d198cd417fb80bd137ba8361120c","first_seen":"2023-05-08T12:10:57Z","last_seen":"2026-05-02T14:40:46.914272Z","times_seen":9,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-ymoney.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-ymoney.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4959\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-135f\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b0hsqSH%2FgpT2ZPgWAyhX7jlz8%2Ft1bWsWo4wkUtRcaEIkIpW%2Ff%2Ft6uFxr%2BTwpsvC68e72JhL8iaVYqKOT%2F8DpwmWP6vQ9hv3HC8yrOinOAFAXVqTmPmtLN97VLnFNrps%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b355db05fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4959,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"6f1e23478d07630f3fef439adf8a3135","sha1":"790aa2e1d0c7f3159119c8e0a813658ec853ce30","sha256":"f491fd1fe6753a2b68aaf073d33a92828e11f55e3fb85dff020fea44cc5c3f8c","sha512":"fc03573b4d3c76a35d10dfeb0c5985a2ccccd122998ea759cb87349560dfdccdcb3967347f74e6dd8989477cc7cdfa46b5562a249032f6041af05d1d47eaae8a","ssdeep":"96:qhXKf53gyBE5wx3rTvW8Y0yNr6/3z/wnGIiucIp8u4MDQD95:3wyWMTer6jqJp8p","tlshash":"40a18dee6a78475cf82d80e7cbd041b7e83d58c102c5de6db77e5cc6093aad89190095","first_seen":"2023-05-08T12:10:57Z","last_seen":"2026-05-02T14:40:46.92231Z","times_seen":10,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/sberbank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/sberbank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-7cf\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gszqsc%2BaD1SRIp8lsswlUOx7uC1oVv11qgb5PN%2BG%2BP4veBa6%2BgD7tup8tUagHMig9x55Folo%2BnqxXTR0PyqEcadb5iB1klfZ9fQCJkNCkWvWUJdb%2FrJqXEMnc7tKeu4%3D\"}]}\r\ncf-ray: 9e299b357dc05fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1999,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a62b00a03076c6894dbb3268fd2588de","sha1":"4b9a5024436164089be9686aedd5a398b2238c03","sha256":"f0fdec7844cd3990ac8b5dbffeba79963cc589aafdb5678adc9f11e07a5a2912","sha512":"c066861e14776ef4ef92731f7316cf7cff1a0722fb2a5282397ba0dfb3a9a71e430e595325fa3b5c9aeb687e260761b863f1e1af5891161524c1112fc155fa88","ssdeep":"","tlshash":"7d41412d83cc4923423d933cebf9ad9caa6550db0281a9cc32e5b51f9c31cd0192f724","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:47.007826Z","times_seen":7,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-pochtabank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-pochtabank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2124\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-84c\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fQOnVyAHMNECAIEulblqzl7W78aWuqdQSo8qZJDpx2JbUhYJZNuVLhdtwfnR%2BkoBDpPWNbQtNReKlqVtU853ZriXPvLt5T86ikmEqRW6JQqalC7khm%2FKHkCHcXv%2BXH0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b359dce5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2124,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGB, non-interlaced","md5":"b280b46652d5e30aa21ebe2bfc72fa7e","sha1":"d114563183b50a3fe4a4c5aa26ece0b20a4aa21a","sha256":"7e7f265f8e3fcd59235836e8897c6d2cf4bd663918f19af56a8414f930556298","sha512":"8ad7254187b3bc40c77fe14cd7a6f078db629b6f37569e30424503126bb9016cac33930e632e7a3b5a2ac5e2c9c3c060e2341ae99d19becf5d543d45b1c080be","ssdeep":"","tlshash":"6b41fa8fd9953140d02a9cc218f142b75e7b4f4155d4fda6709be91799a03a5e0df0e3","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.975991Z","times_seen":35,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/bestchange.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/bestchange.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 9330\r\nlast-modified: Wed, 09 Jul 2025 10:16:17 GMT\r\netag: \"686e4171-2472\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gkYV6LYaiosfwUWEnxOxccM9CXOc2bYJbPcObRryIrtSCFQaREvh0ygxCkYjT7H3U8Ia8WX6l0b3UcSu9gR5M0QOvbTNp5v1tAMVJyz6MlWxIr4TVYiaUlwLjULNIV4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35dde45fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9330,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 340 x 71, 8-bit gray+alpha, non-interlaced","md5":"db6d44230ec1b125bdddaadcc663e56d","sha1":"b447647d51bbd5ebc9b16a19ec745069fc036524","sha256":"a82a2d22bfe51ab5baefaff48e3b334188c9d4e24334573769461483484dcef5","sha512":"fa3f408f2d92f6da2778ea9726358575a212134d1e2e8feb17efb71652de2455157aef042e5bde87f118cdd5ea46d4f83dca295a1983f043010b3da3ec5bc584","ssdeep":"192:upIG5XX07vV5cW6tVYGn1KVVOZxyziE1/GCxDBUNQ0fD7yWL:upIG50HcjBn1KaZIiEVFqQ0fXb","tlshash":"7912afd5aa6af02dcc16b6f879b9f1e3523517086b5b24bf0bee0c6a3e7c0610129310","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.998045Z","times_seen":6,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:46.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 502 Bad Gateway\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Thu, 26 Mar 2026 22:31:47 GMT\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 6453\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9e299b8389225fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":1463,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1463,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/litecoin.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/litecoin.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-1263\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=doGbPhwpPtPtk8H%2Bw6ukJMgZkm0EXT%2FVYIEo9dSwUYBbP%2BihOaQBCzwSg4eZUt6%2F03%2BKDL5w762n4ECXHCOic%2BdZwlPzrLPvhgyr08rdFrcysl80mPHa%2FH%2BXQQA%2FBZw%3D\"}]}\r\ncf-ray: 9e299b34fd8e5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4707,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"679c8e22d84d7bd07c6e8ef314ca6c86","sha1":"f944b870cc1c89474544e27289a4ba23b6eda403","sha256":"e7caa756c84f58e752e653baad79a3fc6772ecc64437d3c67ddc2c6aa7b595ec","sha512":"9b48c5b53014218d0294041a60dc10c112b4300df43c030b5a331f39b88f527410596a7270d00c0e6ba6003ea9c8071d80deeff7de5aa7a2573277b48a410237","ssdeep":"96:hQedan7eGvnW88WkbGD7KI9MtAQKF2hPQqR7WV9JTA1:hQxnJ8WkxGSTMs1","tlshash":"5ba137bc43e40cf4fa0a53f4d8691ee53a8a58ffdb8050cd7195bc939b27d54191a988","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.982182Z","times_seen":10,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/changes/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:42.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"POST /en/changes/ HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 202\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490; hash=35ba699a6c4e5c3ace792a134f0e3e75; resolution=1280%2C1024\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":202,"data":"action=getChanges\u0026currpage=https%3A%2F%2Froyalcash.cc%2Fen%2F\u0026data%5Bcourse_init%5D=true\u0026in_background=true\u0026queryID=1774564302903\u0026callback=%3A%3A17745642948240_6\u0026query_version=1.1\u0026url=%2Fen%2Fchanges%2F"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:42 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kg5ziq35J3PH68Vw5%2FXCR473KAhM%2FdSt4sY%2B636h2GAfOOYfXX0Kr3AjiOLwQQlyjZ2XvFtj%2B9CUrNqli%2BUb%2FQlS6zOnWeQHNLShvXU7e6nri1Vmn4rv%2FWAaJyTyVVM%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9e299b6d38925fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":448,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"d66d7498e147c3c7ff53d26ab8e0a62c","sha1":"e867b4886851d580dbb9da4a6eff129fa30dbd85","sha256":"a8d908b4aee82792d4654760980fd357e760a8ad9cb7ef6658470805d3a73591","sha512":"7ff84b8ae014082e9641611c158be52d0a8dfbd6c1e5e84040e2363b3469e53c550f8f25f8894bec8857eb993b146e75f6b953bb72e912a46c55eda4e0f79344","ssdeep":"","tlshash":"31f0a3501ddf2d5b1da1e34b114f31c354eb00d995bf55568df4dd4c08d900e9d1dd4a","first_seen":"2026-03-26T22:32:14.147614Z","last_seen":"2026-03-26T22:32:14.147614Z","times_seen":1,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-sbp2.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-sbp2.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 49923\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-c303\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sZRx3MbQspMM8G2%2FL2CsmvHLAqcIXjxyoOJXL8%2FgWIyb61jiQDuHtJe7iQDGyvXse%2F6QMCSg1ffrCxtnt6yEfT%2F%2FE%2BpCbgOgGbACwWr%2BmTKKfFsmmAm8NBmeTPc4urE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b357dbf5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49923,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 301, 8-bit/color RGBA, non-interlaced","md5":"2f12df38ebf0ae2fd712a20bbf59aec3","sha1":"eee9792e25eb676b79e384c065cc4f909ac60501","sha256":"e89022f1bc042c836cd6a077d98a7af85fd081a8a7de7755991ca0c8007118c5","sha512":"6b088f15583ba9a412e85329df0e0c87479b69a901ef1ba130cb77572ab33c6a5f0ccb5c5314a7098cdd53f6d421378f26df6b74ac9bbf8f80e5d27c5d1ff961","ssdeep":"1536:xXhQa45RtFYqZrdR0jk9gIoiVdElMVzqtjQXRE:JhQa45r9wk2IoiQOVzqtsXe","tlshash":"4723014496b6d231e3dd590ea62c870912df91dde0d70c63dc4e2884303aae775f4a8e","first_seen":"2023-05-21T12:03:59Z","last_seen":"2026-05-02T14:40:46.984091Z","times_seen":27,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-homecreditbank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-homecreditbank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 993\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-3e1\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yUxsL%2FM6SeEhX2JDsNZmNkRsQqJIhGXKR12wik1MG%2FJmBXHU1aDl3VaLWsSLUWcBi9AUvXDJUqHNaqQNzmZ%2F0j7e%2B1xEF8MjU3QSzzPl5taEandWXuKQH%2BaPCqFmIN4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35add35fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":993,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGB, non-interlaced","md5":"c5e93bbce430f372103c685535388d41","sha1":"dcc2b984480545b7f1ac8d58bae403062cc11d62","sha256":"11964a2639965d5f6a93d56f975f7f627027a2e0db5b841bc2fc8a2d41a95825","sha512":"fefebfbaf5f8b576258a1df6e9db7143f9590898f36fcd4f7c8a8750d1a6f73318b927074ddc0cbc4c46ab5a7da72dad04a644dbc112ce948619b05c3f134c3f","ssdeep":"","tlshash":"11110e4eba52e8006098dd9158fb001ba93f4a80a5e1f47df5cec40249342ba04996fb","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.953377Z","times_seen":23,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/et.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/et.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 7940\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-1f04\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O55zggFaldqO8B9%2FNzSRKRlLIhIHiICRDf4fG%2BMA4vgqTrEpqdRPD8ECHDtrCgr4IEeh5qGEsAbeT4XS%2BujDlwxHSDkMGvhsAwmY6tUeWJDD7%2BrqGULYmO%2BPvRdZ76Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd7d5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7940,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1698 x 1079, 8-bit/color RGB, non-interlaced","md5":"997e07380217c989dd55c26a7e4e909f","sha1":"a0428f0a1c286cffe6b04f8570d8a8324324753a","sha256":"f50ec8c63b735419439737ded61c2ae00378fbbdf76babee36df2cce160fb57a","sha512":"fa52f1b186ac0c5067434af627bda5202ef1ec0ba015b678c3db1d3613ccb17e47a49741197e5bcab735b024512cfeb5a723fc5a08f5ae8e2b45b7e1e61ef166","ssdeep":"96:T2zv4OryHkJffffffffffffffffffffffffGxxxxxxxxxxxxxxxxxxxxxxxxxxx2:wffffffffffffffffffffffffcU","tlshash":"6ff12023214b2d4be528357f517069c36feb997945da4bd68833b4accc8b25b42e22d3","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.929625Z","times_seen":38,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-atom.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-atom.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3591\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-e07\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FfgzYXYo1kK6whDosaLt54HRptcEVgpG5Huy%2B72%2BwwOfbnLWQoHpzeVhVq32Dgqvvk5Mog%2BGYw%2FjZuEZod7t7fLJVttozAOGFyczqQC2hTZQHEm67d03DRZAATNcuAg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b355dab5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3591,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"8fd811fe95231cf6c8a862f39ba7c8d0","sha1":"dc44038a2bf59ef25aeccb6d67486b1d49241bc3","sha256":"28bac5a9ef3fdd8ecea864f6a9e491296f814fb68ed8811f3c4b6bef3b79cca4","sha512":"848e186d2ca0087d7183729041176840df3fbf1b5a720ce05451165ee2840c6ef8e37edad88ddc21595ca40de44b74b94af34a93a3ca24b5c6bd36ebec541fcb","ssdeep":"","tlshash":"73716d5f631d1b4da0d742b24bbfc555645aebd88cf0ac942f0cee204d875a39fa802c","first_seen":"2023-05-06T12:03:53Z","last_seen":"2026-05-02T14:40:46.951281Z","times_seen":34,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/vtb_v3.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/vtb_v3.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-265\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6PZ60jnNkr4%2FeywNI0mR%2FMvh%2F60nP9W9ElMkOHjWV%2BverrFCNOUyPNKkAKegJFsHBtvklJeNrQ1Pr0pVTJidI9vdSbnL2nqVFaLS1rZiys2%2BYByt45snSQ2%2Fy%2FJcGuI%3D\"}]}\r\ncf-ray: 9e299b358dc25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":613,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e1a6932fef6d41759c918863a1dd30e0","sha1":"6c14ceabb4a2dab07e4f2003a09a96fd2ff9b8a0","sha256":"d73b1e624b218bfeb84517eb8c047fe76c6f9dcc94a73b37254e32502b9b9a8b","sha512":"7ad4cd018c03befacb9b06fe9637d185323a695ef61154d73595ee5d6afccf05dc529f98028061dd3503ad53da3bc10f34c50467795a02128aa3a4af8925f5bd","ssdeep":"","tlshash":"71f0ddbd53a48fc9c6848adab301e46a62a044f5e504cb0cd5e722053ca3a62f954e58","first_seen":"2025-10-01T10:54:28.520323Z","last_seen":"2026-05-02T14:40:46.90596Z","times_seen":13,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/utopia-logo-black@2x.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/utopia-logo-black@2x.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3871\r\nlast-modified: Wed, 18 Sep 2024 18:13:21 GMT\r\netag: \"66eb1841-f1f\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I18Y2laODxfGISvuWypVAYoqqFQfXK06Hf9MBlLeQEPtkNYlpUeeTzhrdDQzmYxLwOpfJuVHjysV8Itg19mGfVu%2BrT0xfIoOhW28MCA7qKlHV%2FoqxYkDmv%2BttyxNzoE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34ed865fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3871,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 374 x 244, 8-bit colormap, non-interlaced","md5":"b27dd818adceaeaa75e47056c183ee10","sha1":"7ff0e0b352edb1411ca91503611d00138794ba0f","sha256":"e8b3431df9402c43f800b8c44b028581d5768d901b6f5dc019b99d50bad1d483","sha512":"98c279ea51f541d0b34f929bc70b80c1c561e2daef6a3d0e71d11db4269fc7201106185081fe09c6097c4f9706599ca55f5400d2b797616ddbf96cd259a983fc","ssdeep":"","tlshash":"fd815cb5909235acc034157ca7d66f60c1c31a8eca62c882bd768e4aaef51bcc789317","first_seen":"2026-03-26T22:32:14.156066Z","last_seen":"2026-05-02T14:40:46.919677Z","times_seen":3,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-arbitrum.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-arbitrum.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2797\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-aed\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QnEklE7jPMgExJQ3Y5jQI5BWVbGuOVp%2FLWVBZZqZHwEXHPYqHWCbNRhawlp8U3K%2F%2By75VTdskO6HhPTXMtGu8W4PTkczK5kp5JEnGnQhk0z3glHBpcf8pMcc8Bky3X0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b351da05fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2797,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"a92870349af2f5724f854dc33d2e26fd","sha1":"94b13a3acd56736ef9e5052d5e8476524fa0494d","sha256":"3199870e926985b208d153f4d4d2ad7dc53ce0e0965b7e02033265ac9360f3a7","sha512":"bdf005d583a061af92ac48206b6885770a2e840cc25f4c773b6d051156a475c73c36413a3f428d38535477c7104ca431040e3ceff6921b9dbc86cc7b9a5850df","ssdeep":"","tlshash":"e6512c8afae09840e407e0c13ce7a507ba2f1645a7d1a4f578ed753b6cb80fb051d5a7","first_seen":"2023-05-16T12:20:21Z","last_seen":"2026-05-02T14:40:47.005331Z","times_seen":5,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-halykbank.png?v=2","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-halykbank.png?v=2 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 14228\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-3794\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6FqDjAKj4yxtnL1XMIU%2FcuAxijqyxh%2FZ5Z6ff2VLZ74iD97bZHiPen1HrsMywO6AdP9AVK0RSFekzRzxPB5AJjw19kUt%2BQwkU90T2pw4eazuzMnVfsr%2F27maXrqA1k8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cdde5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14228,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 478 x 477, 8-bit/color RGBA, non-interlaced","md5":"03df1fe68a266d1ca8ba6bb5efe36d19","sha1":"1e79cb9a5525f469712bdedfd493b554e1ee6e3c","sha256":"68ef31c2ba692fed5ea5d000065a0625b757ad04af4bd9fe24d17979cb89f923","sha512":"a6443ba780f0c882ce00a537a68ad1bdbd900107999fae0145f44b0caedfc410246b8e025663adb7e8c9a64086dfe2d4a09bfc491662afc1b7c500436645473c","ssdeep":"384:uAqYnB22TJyXKdcDWdD0vbjF+jZJCp/ffMWLzM:jqYB1TJLOCdGjF+ju/XMWvM","tlshash":"1652cf01b0ffc3aedc0eb87d6aee96b56012dea9826c306059db5c1c7927a74068330d","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.938308Z","times_seen":25,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/tether.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/tether.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-4c4\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SY%2BL%2BYQAzXsXQUazqqjY7iUigDeJeQ7SLtL6cWxoxLKw%2Bbrf%2Bc87A3JJEpTUM673DJ%2Bbud4on3zYtiGHgT3W75G4UeD%2BztEjDd23X4wPZJyLScHkmAh58N8myiL2Yzc%3D\"}]}\r\ncf-ray: 9e299b34ed875fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1220,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cb021c080f053507e3a62829f5264738","sha1":"010198cbd750898c471cf15fbcdc7429f66e9d37","sha256":"912a689f319452adc36dd1307350f51615688aa992893c1de690a491681ca8b1","sha512":"c15d9e08775ac489d374bdbdaff62bf9b79060515efad528dc1cfbf19ce85bde97ea70fa50c2984f953ba3d0a3c7a7966b86b67e7944064086b78c8058c9b846","ssdeep":"","tlshash":"7b21b45c0182440e80fe43a1fefc49c8af79c80b517648ccf9a674278d36fba8103a79","first_seen":"2023-05-08T12:10:57Z","last_seen":"2026-05-02T14:40:46.898341Z","times_seen":22,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":143,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 05 Mar 2026 05:27:05 GMT","end":"Wed, 03 Jun 2026 06:27:01 GMT"},"fingerprint":{"sha1":"04:A8:A2:DB:A5:D9:6E:A1:96:19:8E:E4:20:63:9D:DD:4B:05:E5:4A","sha256":"86:F0:31:59:6F:27:50:6B:1C:65:39:9A:BF:6D:0C:A8:82:D5:B2:A6:36:4B:9C:0A:EB:05:EE:13:0F:EE:25:EC"}}},"request":{"raw":"GET /bootstrap/4.5.0/js/bootstrap.min.js HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"6bea60c34c5db6797150610dacdc6bce\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:10 GMT\r\ncdn-cachedat: 08/01/2025 14:01:49\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1333\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: da3285f0cc8890bb99f509ce38fb888d\r\ncdn-cache: HIT\r\ncf-cache-status: HIT\r\ncf-ray: 9e299b35ebb25691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60174,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (59893)","md5":"6bea60c34c5db6797150610dacdc6bce","sha1":"544afefd148715da7dd52d368a414703390ca0e0","sha256":"38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff","sha512":"2394e4bad0290e39d6b97fac98b20f64d870f8b85377c5ab4217422acc421514af845c76926f197c4a4d22117d9ead389ac1e13a413c04c3818f9404d3bca130","ssdeep":"768:WLlcnSRAIvHVAYIE8Pg76Tjx4vbh3p6viDl0TS6SXH6G7e6Pxh35CCmVla4:WLl4SE0MJS36GPxhAV1","tlshash":"c743a54a7254787206df747a817b060bb3366c99a40a816cb8699ced2f7cd493277f3c","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-06-08T03:53:20.019451Z","times_seen":8310,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/js/fingerprint2.js?_=1774564294649","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/js/fingerprint2.js?_=1774564294649 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: W/\"686661f0-f78b\"\r\nexpires: Tue, 22 Sep 2026 22:31:35 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yd0aUVwUyzpdqD1fdjbJpOaWDtQh8ruSwEZsOxxJKQ%2BLu%2Fwxpr6XNnNv6rCkz%2Bi2sDtHRlRjQ9qhiK4FEkCGhHKhiClFW3IDwDCKPz3WYikJrsS0NgzFOXBgFGNgDf8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b3d2e395fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63371,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (331), with CRLF line terminators","md5":"fa04bb0e8fc3bf4bca57fb4b78a5f32f","sha1":"071f178266610af9b8fb6b702f6d2332535d97ef","sha256":"7fafa4142930ac9296befa317770842d07da85bcb61de4b7ae4788193f0e5cb0","sha512":"0121a5435d5ccc5ab8c90fccbe095d764736a1eebae7d60508f9aaf12aaef3e35916588b7dc57dfd2b44550c33a912466b01a00a73ed578e136b1ba080aeab40","ssdeep":"768:9AR9B9XkSqQA4uq5SEGUQEDqPLUUMjZL1iwmyu3j9NERYhP:96B5kSqj4F5SjxEUgiwmb3j9NERYhP","tlshash":"af53d69b1e8231260533b3366b5f980af63a5073c11694497c7d82906ff2c6953baff9","first_seen":"2023-03-10T00:47:56Z","last_seen":"2026-05-03T04:37:35.724667Z","times_seen":41,"resource_available":true,"data":null}},"time_used":234,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-revolut.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-revolut.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 6687\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-1a1f\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9IfNRqgWef8EuspTxROMAXBeFrAjyunuFui7Gr8ariTKDmv0WBrPDqNHprIb6Nn9KwCAQ0%2B%2FFNtTO7h9Ust8rZMvn%2Bunrd6S9xuFTjW76f236EHQ7VDeCyApr9eSp%2BY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6687,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"b47dae0798e11634baae1cd74a873a90","sha1":"e9c4072a265a50268beaceff2184b8202c006a42","sha256":"d8db090e338aad5525cd2ee8c8a33bc63cf28186fed714a7f843f27ab269e3c8","sha512":"4f83003cb7eb0a1b1945d5ff7f1aaed61ed4a47b82f7d3bb4e33be82a9e03a7b3dcd9aca80a6fdd20b36afb0411ff3786943bba0b30b8738bb82ef41e38826b4","ssdeep":"192:KZh+SZyH34E33gkyK66TepHwd8pL/xc6smU8Xp2S/pen:Kz+SyukyCTMwdm/zsz85sn","tlshash":"97d18d5bf1b6f196c14e52c760dadb8aab7801c3c36602ca6e5bf6361fd4988424242a","first_seen":"2023-10-24T12:07:04Z","last_seen":"2026-05-02T14:40:46.93189Z","times_seen":15,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-visamc.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-visamc.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2393\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-959\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xlta%2BRKCuCKH0lInTB9dw%2BzUPorOX88mFeqnmtrorRZFnljeCW6R9L7C%2FGZjJ9azhlqtOuuRs5nbclY8T3syb9bIDCqJ04HQjlwTETC7c0649jxwtvHKwfeJXQCYFj4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd95fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2393,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"007ac3c88d28cf9b0888edb4048ca0a7","sha1":"1e52b9d7ca3c282140457d195d30d89e226a1ddf","sha256":"cd916be6fe01e7c89a2581fb089d9daa7a806a8b0e537d461b40a38ff27f460f","sha512":"f17a73bf614d6663707365b27857234c8ace4ad0baac3e9ed1b796aa526c115187a4dd8704ff591c95ea5fd03536276f660f11d984222f109742254eb9e13d37","ssdeep":"","tlshash":"7d410aabf210b4815988883c188f485fcd534f4481e4d4a6bcd4de2a1c78be34467def","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.96743Z","times_seen":30,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-fortebank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-fortebank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 7069\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-1b9d\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jvKskJ861T4Yaikz8WnXlcSk5h4wxYcHCKGeJ9WEghJHhXgItw1ZQ3xI9My%2FYzNPmq%2BeCtfDn3%2BqEmQneOj7Dp%2BVZTPh1ogNrV7nsAzFJzopZCsNtrXz1QFyK1ZGYTw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cde15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 87, 8-bit/color RGBA, non-interlaced","md5":"8df44991325be6ed204d0399c157f8d3","sha1":"86cd9a88c2fd3d0506dfb9a5e002835855fe4e2f","sha256":"f9259fdf6a7ecbd5c07c7b7486ea83d04217014acc01897b4c7fbc4b16b36dd4","sha512":"9800683bd45576d59c66f1e6ea205fc5ba80777b0d1dd4da7572ec6752ad7c7ef03ab97d8c334bcff646310199d4f5ef81587a9f4b1d394271f05c8b4018fba1","ssdeep":"96:x6nCgAtocfvEU+gWIUldYSBFVnhpXX0rqYrsQ7BQ16cb7sDTNkggZF+xpvGjCXUf:8A+iuIOxFxn0rqmpGx7s9k4GjCXU3P","tlshash":"3ae1ae711a70dbaf0ea731ea6897f402bbae5688275f6b5d8606044d144039b3d82d7e","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.9274Z","times_seen":20,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/changes/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:39.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"POST /en/changes/ HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 290\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":290,"data":"action=getChanges\u0026currpage=https%3A%2F%2Froyalcash.cc%2Fen%2F\u0026data%5Bcourse_init%5D=true\u0026data%5Bclient_dump%5D=35ba699a6c4e5c3ace792a134f0e3e75%3B1280%2C1024\u0026in_background=true\u0026sri=17745642948240\u0026queryID=1774564299789\u0026callback=%3A%3A17745642948240_4\u0026query_version=1.1\u0026url=%2Fen%2Fchanges%2F"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:39 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nset-cookie: hash=35ba699a6c4e5c3ace792a134f0e3e75; expires=Thu, 02 Apr 2026 22:31:39 GMT; Max-Age=604800; path=/; secure; HttpOnly\nresolution=1280%2C1024; expires=Thu, 02 Apr 2026 22:31:39 GMT; Max-Age=604800; path=/; secure; HttpOnly\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QWK%2FhwQsVQwM6apbvmuvkgQP8q4n8B3QnHr%2FWljbqCRleLM3wvb%2B3SrCAOfxL3d8glJd5stepgjwkGEHnBZ3XhKYDQZEycIieoFalL9Tb2nQj3sDScuB4PVWT050y5Q%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9e299b59cfdf5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2421,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"3d597c4c8f815294ed3488f8155d6ef5","sha1":"aea5cf7072e7e5a14cbac8b6d83e04357f5b784e","sha256":"664d77197667337425ce03eaf5261eee90d92611e3c8ce009917c0a6a11391cd","sha512":"1e250c75b4f3a7c7606e050f540a94a8ba702aaebf494c42f24202f1f163fd1a9ee2c8033082d69f6ccde1f980cd9c114daa7aaedbb2b237979e15827b2396d4","ssdeep":"","tlshash":"de4168a2f0f4b191e5adb6b7030d9c7ed88bc15ad84abce903bc6724cf5930eb608454","first_seen":"2026-03-26T22:32:14.166941Z","last_seen":"2026-03-26T22:32:14.166941Z","times_seen":1,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":67,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/skrill.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/skrill.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-6c3\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xZ%2Fun9jYBrsGDzaHY%2FqyyVuGm%2BrI9x3YfOVZ8kA7zIX4U1kmLg8%2FU%2B95%2F0McJ7FlyCUMMRoE9zyuCEaHgEnap4BIE1dHMv5Pvku8fxU95rTr3Fj6rNSojf7c63Zrue0%3D\"}]}\r\ncf-ray: 9e299b356db55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1731,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cde186dfa39c88e72737771113610e69","sha1":"46d207780c4dfe4fc1c59fa8aa41abe93b436411","sha256":"a2386cf5077fc9d6b819ed81450f4cb89e1a6a2783979ba3e6fdb4142c88bf20","sha512":"44eaf11f263835c9616d378f4f647c7e4892915f9979185f2e1fe7104de311fb457af6d457f2cb2f243d69146ad314f90302f25ee59980ab63c22ae8639594bd","ssdeep":"","tlshash":"a83196c2d3a5a57c75494b2ce438ba862273216532b6459cc2cc5d236c07f723330df0","first_seen":"2023-10-24T12:07:04Z","last_seen":"2026-05-02T14:40:46.93089Z","times_seen":7,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-uusd.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-uusd.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1795\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-703\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jzYqwugt0SeYUSqyVxM8be2VOqSAj0XXJtFk0h2IutGJtB4wjO4FnRioQNc7%2FxEFxADCEbHcKz9mf7sIXtsR9F6qN0Nn8xazH%2FskPLupxz8xGH%2BftSqHZ0JdXsC8HfM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34ed895fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1795,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"8244f5e7b6004e1f5552cb7bb50fd82e","sha1":"47f3906a9577b5addb77a98a4465147d85c4b5fa","sha256":"0d3b8c49ca1e8400e2890ff0870cea0b713d44362c8a1969d909d6c15ea77328","sha512":"1d81ad8857f40bca7096bae975c987dd321274ae7a4b1b396c5f655c12c38a7b8bc1b24a7d8e061455b7c261d07eeefe838e1070a0248118f7ec842860445acf","ssdeep":"","tlshash":"82312d76999550f1d4848a4c115ea2dd10a3d32c26f26fa5f35ffcec51440fb306d85e","first_seen":"2025-10-01T10:54:28.555886Z","last_seen":"2026-05-02T14:40:47.045974Z","times_seen":4,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/flags/thb.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/flags/thb.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1027\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-403\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oCtY822doDCh8t32NO3XIR%2B19ElOtC%2F9POt7Mb2HAhQLgi8b4yroGbWxYBpN0WD28DB17yio7ju2DzbWuGcgOIywBeh7C5XXLGkbgtvT%2BBP2jSwAXwHgxSQObn%2BqmQk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cde25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1027,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"8e03206264f7862b4e2fea815320745b","sha1":"ee4bf44ba98cf10f25c2477c1e674ea4337353ef","sha256":"2c16fec4c248812dcc25cd85513242f63decc67f15d229cf493256e5c07af34a","sha512":"c9083998c8dcbba255b4ef503f64332e4325935c7698d9a7b09c63173d477680592fe0129d3dc6dda96941036eeb525f7216c7e1170cd4245fe819146b5e7e35","ssdeep":"","tlshash":"6911724ef6556040d164cec138f38077da174d0189f1e1e2fdcd841308b80f599095cf","first_seen":"2025-10-01T10:54:28.40388Z","last_seen":"2026-05-02T14:40:46.908685Z","times_seen":4,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/ghr.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/ghr.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4929\r\nlast-modified: Wed, 09 Jul 2025 10:16:17 GMT\r\netag: \"686e4171-1341\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2RHorIJigIzTLg4mVqG8n8jiZj4OV5yYe8zg2lFxHq2bQLNK9kQh%2B%2FSjkW1rdKOfYE%2F2AyBIw9h4SV9ZuOHg3IuWi%2BnPJ%2BJ15l6PLLadMi47%2Bd%2BKHKOWppdR91uPvKA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34ed845fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4929,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"7e802f4a41c4384f6f81d642ff379f1f","sha1":"baeee9159220d246c6b2b757751afe22633c04ca","sha256":"e68f5592f9b93cf518f9501a672abe06f97fb3a3ffb23a7e6f809c63f07eac85","sha512":"6e5ecd80aa23d33344cc483868b64a624c7208395db804c7f8ad40070652dcc6b7c87566efb881e5b4df2325ce04e64933da8de0e234da00e3972324980597fe","ssdeep":"96:7cfOEIoUCZO3EwkwMALJUrwMTeMJmDuA6fZw3K1POlHd3ElPSYD/lE8EkNEFISy:ro/O37tRimAfZwIPK93ElPSkl2Z3y","tlshash":"4ba18ea36f99375d84f470fb05a9c2b030b62d26fdbb8783c48bb90589e796c5244dc0","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:47.043106Z","times_seen":4,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-rsnb.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-rsnb.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2258\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-8d2\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wm8IihqB1%2FMMaETDhnV2e7zKhDwLmnBf70dalFxl2rrXRz3ZcHYA2EQE3Ani%2BzgFsu%2BHivGwRD8f3PRtiNUXCQptfZ7VdSZsoKBq7vOq4uxN9tdpYLjTxoV5Tf2eX%2BA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35add25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2258,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"c3e0d961b37d09142872c94057c1a37a","sha1":"a33b3dd815181666a1dd01ae4894fd56254e8d83","sha256":"0e84745852389fbd9b91a48c3b7885b450c79de5146eb1ffe37da6f3a9d7c109","sha512":"c6f81f4d1edf7c95f112313f5d0eae0d50d40bbbacca7bcbcb9de590373e4e46b9245b1a089876335a944c7271c267f8105fc687d4d95c5ab51668462c298e0b","ssdeep":"","tlshash":"9441fb44a9406dc109ec4d1338b75023bb37d944fbd0d51aa4dd880946626fbd01efcf","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.925177Z","times_seen":35,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/wschat/dist/client.js?v=26.1774564294","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/wschat/dist/client.js?v=26.1774564294 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Jul 2025 10:56:54 GMT\r\netag: W/\"686661f6-10383\"\r\nexpires: Tue, 22 Sep 2026 22:31:35 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m7QmOj9lPnJIkrpjDhz6rUadS2BZ%2BCuqLotAdsncs8mWx9ZhClGEjLsvG3lGLA71hwfc2oD%2FCsrHxd1SZrMN65pDjMUT3nQQOcVy0tTYRJckd5YRlH%2FwY5bG2mNZ0Dw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b3c6e115fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66435,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65512), with no line terminators","md5":"b97824c898ac0be8a5adacfaf6fe643c","sha1":"c46b49bf98345f5278f548feaecc69bc4bac72c3","sha256":"8dc7b6257660f4799873f8b1de00702bfc08e3b146181641c752361f6d5c4855","sha512":"b96928bc802c02fce4de36483f2b226c50f423ed3fd2fa148b6e37e74ac04860b186a2cc525ed5b580fdbefffcf08e052f298921e2be9358832ed134946ca309","ssdeep":"768:X3qkjNQFEnAxMk8d69XYSDPr2a70W04A2jKirkqimSX1miBMZnHjhKTiKlJbZWnN:/ppAr849XYSuawWWrR4HdyYN","tlshash":"70535064d640f6ed77018dba3e3e59d8d8261b46908cc7d6a028fc1856c9963f0fc9bd","first_seen":"2026-03-26T22:32:14.174311Z","last_seen":"2026-05-02T14:40:46.886154Z","times_seen":3,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/track","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:36.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/track HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:38 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VmBQggZOhvn60sQGmBq%2Fqj9lFIqMT59npifmQfHxHNeFIFUxiRQWmXnEWLbHQ0dWMUAurlz5ZQaxgcTg5UlBdMeVYR9RO%2F49CmNpN%2BjOa41Ohc0nADVhLYq09XEGaJ%2BpbyJgnkzfYhZYiqJw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b425e795fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":2095,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2095,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-toncoin2.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-toncoin2.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4757\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-1295\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hvS1i9XRuOzeiBOtk9n%2FcqfUoA5SWKDnxT6rks6xHQh2zfqO2YDfEkCZWLJvwXrXd6XydjgQrmC3Cbbx4UXOFGsWamaSpEiICwyyiJwviMsmuVprFgPafD2ckHR%2BTp8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34fd8c5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4757,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"dda4df295d289f1c2247a5493eedced0","sha1":"8c0db07b99fa3fef1350b5f7c1991970eada69fb","sha256":"d9f70d27ea6f7a42ce0d7b1aa7d96c94903457dc68901f745d95b130037005f2","sha512":"c3ea2d76185fe0635092e0cee18e3be8ce045d043a97ea8b7ecd44b85c99ec31a70b7d64316c83bb06437e603d759aa730dd649271bfe27fafe73ab36724292a","ssdeep":"96:6SxlT+ghAzUkSk+9N15PkrhFdj9/ohu4tsq5JeDtRwfbmDMgUVtHZio1hW0:6SxbhcUxJorhj9P4vfeDtCbyMJt5vW0","tlshash":"59a17d1b4dc9d26ba583bf44fbe1f5d8783e7f2e2e8f0418a43a615e894303850a4896","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-16T04:17:49.406653Z","times_seen":124,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/dogecoin.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/dogecoin.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-8b8\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M4mKjMEs5dM%2B4%2FZuRnZMlFr1jYQ22aRcgwNiGhZEyeLs5J1cljkAAKIrRxhXfhVa%2B8Mz%2BEeq1PHyBPO4NFsQ1i2BVBuc67nP%2BYqwsOk9Ym2ZrhuYXBoGHUh8A2RdYhI%3D\"}]}\r\ncf-ray: 9e299b351d9e5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2232,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8eccb7a46473a87b32b0226843ba899c","sha1":"6fe7d936617d197460217a678eefffd5066cc09c","sha256":"a69bf28ae15010733f684dd265711fd991f29795954accfe4c44d8837547d466","sha512":"eca4d85b1e20c03af5aca0bc931cc6210487b88dd5d0f98256038ee9719f8ccb434d6c0cfa04add202cba34475d54036cc78723da22048718b48a0d436615c28","ssdeep":"","tlshash":"2641766ac7810c5ed63bd3f3f6284dc93566128f56ea07cce0f278831e26e389806654","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.84383Z","times_seen":25,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-notcoin.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-notcoin.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 134504\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-20d68\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C%2FVmJJAx66kzLANm2%2BDvkmKqJnMmEb8x8a1eijpqk0w5zHhewNdCPwtc88Z0gv03sR0RCCgOEpYk5c8APn8CqGLlxamjl4OKp3eRU4C8Y8h3hNEUtBbezqtptgl9LEo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b355dac5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":134504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"9fc9e1cdae28f5715ebfee8a86320bdb","sha1":"6d0abd7de6e7a6121a247b9f381095826cdd7d7d","sha256":"3336742c6800c2c6a74707935ad8f6df93a374cb231bf6294a06e458d139e5b5","sha512":"315c6ee650a107cc3c8f80f681531df16ec7773080cccf28a83bd59c500a80801c94a56296dcda40ee3f29b6a499aefdefcb74119a96def5e9312b780ac4b503","ssdeep":"3072:HirHliLgovVmzIMN/AqOUxDKF+6cjAmUa54o:H6HliLgovATJrxDKkjAmTv","tlshash":"a5d3124560f63f55ed2146cb8b18f7e9c126e70beca527ec39c5e6694b78348ac01c8e","first_seen":"2025-06-23T06:58:58.948069Z","last_seen":"2026-05-02T14:40:46.936347Z","times_seen":5,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":167,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/zelle.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/zelle.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-abd\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wUZxVnMmYFdoO%2BqFlsnnq3yI3iBMAQ7n2GdXgNBgTW7rGcnMLjvQcz7Mq3dmpzkgD7klNYrAgcCsdE2ECxMCFu7Q%2BFBsN9eMhZBaYqKthNT8k8CWn7ZTpog46TExSio%3D\"}]}\r\ncf-ray: 9e299b356db45fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2749,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fba5d8aa8711811becaa43bd5469db50","sha1":"0b46483c282c0e3c826b7e41bf49aa45c61f9c28","sha256":"6b6bd08ceb34282761dfacc5c9d0502fe10ddb99d92092d979e6b3c556c5ebe3","sha512":"12f5c94b490207e1e5d5176982aa14f201d1ab47f4e71c2791dcfdc0cc926e99821e7057c341a56c25f34c5e1e29c83403b19fc7f685c8a3d45116e434ddf0d6","ssdeep":"","tlshash":"2551fe69c364e3f4eee6c3bc9e36e4b4a09e808d80e4d329c3e8845075d44dce25c8e9","first_seen":"2023-10-24T12:07:04Z","last_seen":"2026-05-02T14:40:46.98025Z","times_seen":7,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 05 Mar 2026 05:27:05 GMT","end":"Wed, 03 Jun 2026 06:27:01 GMT"},"fingerprint":{"sha1":"04:A8:A2:DB:A5:D9:6E:A1:96:19:8E:E4:20:63:9D:DD:4B:05:E5:4A","sha256":"86:F0:31:59:6F:27:50:6B:1C:65:39:9A:BF:6D:0C:A8:82:D5:B2:A6:36:4B:9C:0A:EB:05:EE:13:0F:EE:25:EC"}}},"request":{"raw":"GET /bootstrap/4.5.0/css/bootstrap.min.css HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 26 Mar 2026 22:31:33 GMT\r\ncontent-type: text/css; charset=utf-8\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"3afe15e976734d9daac26310110c4594\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:10 GMT\r\ncdn-cachedat: 08/01/2025 14:01:49\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1334\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 7b74db4a2bd382b761dc4fc08b2f7a0b\r\ncdn-cache: HIT\r\ncf-cache-status: HIT\r\ncf-ray: 9e299b34eac95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":160403,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65324)","md5":"3afe15e976734d9daac26310110c4594","sha1":"4f14a09a606c99a11f8fda15564ef66f70402826","sha256":"680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c","sha512":"aced925c428148809afc07f28442b966a58508ea24d6b7203d87c63aab57df93b28ab68183a5dae0d9c12705e0a484685de5a370099c42788c869db686d0dcea","ssdeep":"1536:2THqIJOT7SyEIA1pDEBi8yNcuSEeA1/uypq3SYiLENM6HN26H:YH9vGGq3SYiLENM6HN26H","tlshash":"03f353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf8273b6447892c70a73e4c","first_seen":"2023-04-05T04:00:44Z","last_seen":"2026-06-08T10:37:29.956946Z","times_seen":24678,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":53,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-tezos.png?v=2","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-tezos.png?v=2 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 12409\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-3079\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8RL9yZnRjZmj8FarvUpfFVDbGPn8DxeV0QLwVfLDFRwxqlOQVR5xEyaPKT7X1C18ndCXzlNKYwgGLvqssR7L%2B%2Frd%2BFHtB9XBPXGaIxL54bDCodGKjCHvB11AzL7wvj0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b352da55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12409,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 369 x 369, 8-bit/color RGBA, non-interlaced","md5":"659a8fa5f8eb6b3c7ef1da3be9b45862","sha1":"bfa1ec4176c1e8ae572849c0433af2964ccf0d6b","sha256":"7b21837f756a85f36e58a825d7e2799ab1de40182edf765e86cde99afa81d049","sha512":"2b13eb8da024677623fb0377282d6d06bc344630b841e610cbca0e1d89d46c58cd6775ec68d3b128cc51437e3b6d964dc089ee90bef86e6f1f60b093c687d6d5","ssdeep":"384:HdjZzFDAfJfvsnW7pAIlGkIGur64lzUXC:Hdj1YJGI0a3+zUy","tlshash":"7a42bfc83c3bec126f976111647a5c066ebd5a0068ce257c1133ae5eec5167c69fe351","first_seen":"2023-05-06T12:03:53Z","last_seen":"2026-05-02T14:40:46.99199Z","times_seen":32,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/zh.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/zh.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 5449\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-1549\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NUiIEwZjqmueq3XLKGIbtSWjR2xkgOwustHN6CIvFxWjHFt%2BaLWMe97ZpAF7NbEhr6XAnjac5%2FgUNMTxbYGTL7J%2BPiGKp12gAbxjJC9lX2zV9xBpd2uA39ezFbdnmhI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd7e5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5449,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 367, 8-bit/color RGBA, non-interlaced","md5":"d41caca44aa65f9775f99d4e346e9fc1","sha1":"5c26fbea9f9ea92e60d4fa539f3ecaad1a13ec1a","sha256":"6881ddfa162e2d3e25d8425dc0077a9159a13c39a9abea0341b30a92e79fe046","sha512":"94d6f801699fc6c3b3a48dab6a0108658e07d5807d12fc9e7ac8ca83c897fcbf9c20c8df7fdea9e1af5af0e687aede5e355ab6f87698e2791c0e1a250876201b","ssdeep":"96:PxWc1uWLzbf+8xw8yGv9f/F8QNpOXLft+iR9Z:Pwc1frf+8O+diSQLfbN","tlshash":"c2b1080c02a100eb6480e6d5e4967f297775e079ef729f64d0be847d3e3771bc282a48","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-05T20:47:16.695356Z","times_seen":39,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:39.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:40 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m%2FJFqDhLzybTi0qOuB7WVoGhdiqJ0FDNnlCbpJsBGKA%2F7ID%2B1FyFh1kyDlgh27ZauCOgEG1SgqNitz%2Bs%2FkbGqnWNv8KWNohd2IdRDnYn%2BP6S%2Fr3VxaKL3hzmy1Wbm0nEL8VQpSxFcln2rJAR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b588fc75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":638,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":638,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:41.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:42 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ysi9G%2Fy6TeqH866K0%2FGOuwcPBd2HZxX9JWXTaZsbMpMVp9l9UIvBh7vVZioJ3VjUH0MkxntnuOw%2BI7crCjM5r5is4lndXbKIAY31eHj%2BmxxbI2a1A89EN4m6pD1SBQPQq5H5nQVBh23zP3Di\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b65a8355fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":838,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":838,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/ripple.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/ripple.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-614\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WZU2S6HBHO7Ub9d9WS0MWcWJOyJcC%2BVYOtzdKKLolSmcsZ4UkMOGp0gWa%2BF%2F1%2BmOZWmDe97o4PkfO6BFNNaeJKyW7epgEOSquRzqZDd4KOGhU60nG5wiwokjqFZowXA%3D\"}]}\r\ncf-ray: 9e299b350d975fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1556,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"101acc24dc3ad116250027fac8ffb656","sha1":"55e8d278225953fc075f29834d5ce3d174c6d069","sha256":"c9c67f18b69cb4ccc6ff0478031ae5c0986b475d096947dfbb995b2c73966229","sha512":"0015717b46d12ffe6de19b0c22cd4aa69217ea1cbbe6c48cfc96d77c927547ea61380b716ee0b215030a497532449a891db6050e1c9e22c55902e488be5a0b2d","ssdeep":"","tlshash":"3f31ed6b51554c0e52fa8391b9fc0a42ef6dec23313a548d7b6664178e22773c007aa4","first_seen":"2023-05-08T12:10:57Z","last_seen":"2026-05-02T14:40:46.994663Z","times_seen":9,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-avax.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-avax.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2229\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-8b5\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ORu2bcFtJ9XVfKreSs8jC1KCdEyfAkUSng5pwLhQ9Oz9ApiuVZJtcXeRFt1elC3%2FQhgYfpnI96TLhoRfPBerZFF%2Bu2C%2FAZXyPXeZzu5gnSpPmj%2BI14hVU2MIbXFQ%2Fl8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b355daa5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2229,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"6e2d9073c586a251de2ccbc3f32d2aed","sha1":"7e08871a46cfa82d23d64a867bba64ed20c6a201","sha256":"d0dac5c7dc2f32b02194856ab8f754034afead8d3d1f2160f62165ca0cb3e138","sha512":"cb13c319bc38ec3dd728f8498d91e0898e67d9d952f8ea69c504e6cf79f484c52a646074061cada765dd843615fcb3418bcdb956f3993b12908a1ead928e03ab","ssdeep":"","tlshash":"f1415eb04c354e7cf15d9d11496e6d15de104e8747b5eabf1f02df4d52a41610877c1b","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.911722Z","times_seen":44,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-dai.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-dai.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2671\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-a6f\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=21QWtwscjcaMQLsetKfCdx6aSZOGCIBSvu%2BQfPc5OIY3932zesbwDhZ1PNy6drmPMdCjDtWwovnY0jqGkrBogNVnQi82bq94JMWIT4NuVOOicdiRi8lKFYSrGO8mX84%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b350d935fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2671,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"8e26118d7a63338cfef1116720c92e0e","sha1":"8902985faa4db767ea26150e0058886b8874fb37","sha256":"a0ed329b8cd852688196ea87f4496585aeb0047c57b1fadbfc87f7bb8b9cada6","sha512":"d5137311b25651141f093713ba390fbf9403398c35ed1f1178a95a99101ddbdcc4791b7cb60e7f39d7cb8216c9b5a65ea6ab02e61730d398c6bc805f8efbbc49","ssdeep":"","tlshash":"39513bdc736f68c4999581dbda64c9cc91092c1ded09a4431ee838733cb8bc28b2749a","first_seen":"2023-05-06T12:21:16Z","last_seen":"2026-06-08T09:03:19.61912Z","times_seen":284,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-kaspi.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-kaspi.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 37646\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-930e\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fEH8I8usU39taf64CoHURuWeDDufrW13sf7ykKdL4VvHKiWwkpdrTMk3iJVN5TZY4i94Iz%2BlL%2FxZg13LdGQRdMdplprU%2BECFRbxUTdM7RS6QtfUJICeIfncQH89w2Gw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bddd5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37646,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 349 x 349, 8-bit/color RGBA, non-interlaced","md5":"2939ca4e833333594d5d71dda2207529","sha1":"459e01414d0ab2ac906f680dc25dde3909b933e9","sha256":"c62918c6cec9de369fad43bcda1ffb579dee8984718193503789a274d761dcd2","sha512":"410ed46214f18de6c431f8c06a90ea6e0b08350c5d1fe059779f53a2a4668b50222a3a7b07073630909ff9f5c233136e7b511fc3c7d3d3e075ec876902d4c70e","ssdeep":"768:45i4/u3fHNUZc6SEpXrAmCZSucu9f2E8N49xejqb/5:447NU7PXrAF3+N4ij8/5","tlshash":"8af2f1a7157dad1be00c9f7363431280dba7073fad32e62a162693279b79fc864b5841","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.956643Z","times_seen":31,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/bitcoinmarket.gif","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/bitcoinmarket.gif HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/gif\r\ncontent-length: 32229\r\nlast-modified: Wed, 01 Oct 2025 09:54:48 GMT\r\netag: \"68dcfa68-7de5\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QAQXt7IKqs8BEx9KxlPSeOMWy3PRDi%2FdWL0x%2FqAkCxxLidihizyoaBMphhxAy7F8xJPTsOBnz6UTwvEVCSwJtt3fCDX3xDr%2FUlGE0Hp0VK%2BVS8vDWYa6CHg1rhqBMmc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35dde55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32229,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 88 x 31","md5":"d40df225969e26e3a0ce5e4dce3af192","sha1":"23992003d815ff5d6de4a3c5ab3151817fad957b","sha256":"6ab43834f8624141520102b84ac4a1a5594b20d3c767e1395fd0f5b2c4d4b190","sha512":"3e7479238940c39967fd02a044ea05206384b42fd513a7b8c78b5251d62593698c57f0607994ca50b5986437755180d843e965b08a20d54a656c5c98bc4bd025","ssdeep":"768:dRVmOklm7OZJ6m1WFHsBWZrDWR+RTiz8MsR09eAAh:1ksylEFHsBArCRCk8MiueX","tlshash":"c3e26b0ece0d9c4dc47299b5032d6a59631cfd7e1a48926f68ccab75f81b1bd2c8f246","first_seen":"2024-01-21T12:22:29Z","last_seen":"2026-05-19T19:02:51.251108Z","times_seen":25,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 27748\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ec4-15851\"\r\nlast-modified: Mon, 04 May 2020 16:11:48 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 137320\r\nexpires: Tue, 16 Mar 2027 22:31:34 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e8K4qzxcT6k6WdEb1Enuify1VRGxfJQ53r9cjBVhb%2BtZjTTCsnVbpMZWs2db5q2LFdxzSWQp9bpDEhozU47ieUvwI01BnmW8OPz%2BMiLaDxk9L7XMb0JkdjviN94HydDDspt%2FfSOv\"}]}\r\ncf-ray: 9e299b36084b0b55-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88145,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-06-08T11:38:24.524573Z","times_seen":133031,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":12,"receive":2,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/tr.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/tr.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 13511\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-34c7\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZHYTtdm22ZMGYmIvrrbDMPbfAzDbM2NsE7TOciF4s%2FlNsbmugUwdBXk681%2FiWIDYq7N8VMxM5FjPEXFnD8QxGLh8oWFtXS12wHcnqnnd7BOC%2Fel%2B6DO9eP0icbHFpX0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd825fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13511,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 366, 8-bit/color RGBA, non-interlaced","md5":"5bbf3c70625e76da1249057465f1dc26","sha1":"f837a7ec7c336394096513f4a8d0970c49d85cd2","sha256":"b29c1264af37aa90af8236f231b155af48e3f2b347822c180f7316d03833d5e7","sha512":"4b94dbfda344ecd0789d37f0bbf00e815e39df357052c47d3ac033a72fafe82216c66736bc2677391ad3f9f66326b49ddbed570dfc8a5cd84ddeae5f707347c4","ssdeep":"384:BthRTt8zYAV8DF13qqPZy1iWmt/y06rB+EPqm1:PTTt8zdVjqxy1jmt/y1BLqm1","tlshash":"b6529dad57b61470633c4d51825cc7212742488fe79222e574eff8cb2919222cf2bfe8","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.96564Z","times_seen":36,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/de.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/de.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 247\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-f7\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xhHZe5mp%2BH%2BYU%2BBZccUoqvXpjyu2uC2uuDm14xGVBaq2Vj%2FQph6OAIdn3jdAiQPKXUIeaNtZTT8Hgkh792cbBKOXB8E6HF5cCygjR4ZpU7qCWOTka7V6fVVCdQ1kGWg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd805fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":247,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 330, 2-bit colormap, non-interlaced","md5":"3079aa60cfa365a59a9ac456924cfa81","sha1":"9d34e98086bc5a428c76281dff91dbf9bbfce280","sha256":"56982c307ca2efe68562aa3af7299127d1e3da47e0737f96c2a3e257027fc8ff","sha512":"5cc035cddfeb3581d823787d7ebd1814941af6da7deb3a1aafa2bd1617f26110296d05cadb18de7a0b9078f4fba34e72e505c11cdfff6a9b99b29385fccad9ce","ssdeep":"","tlshash":"f5d02bcf1bcf0c70d742cbf75134c0316969123d021001869842d722b0c7703c240883","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-05T20:47:16.70158Z","times_seen":39,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-wm.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-wm.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2056\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-808\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SyEld1BJq4atb6wcjQ27gNwxyg%2FxmRJpBravJllKP8rutfRg04ol2eQTshLJgu6NgmycsCnNWfGD1UPn2LtCzrjyOHJEbP8sQe%2BT%2FQfuPvnD12e2Sr17x8QNTs2vtbc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2056,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"10ca9dcd7f15fdf20aeeae10a85e1d35","sha1":"df7b098d8abf0d909427b574fd576bc2aa7767e9","sha256":"76b047ea13c8d2045e1b2e2b50d1bcd505db9bfeecbb6c73d4949ebecd68756a","sha512":"e96b794c0ebc6516520cfeda6047c0dbe05ab7d23b45ff71f82c1e312eae272864cf7d759bd0db73ed85e6143825ecac00b059b2ab699a57425e544764186e01","ssdeep":"","tlshash":"38414ee5b5158814d60fe477038deb13da97050167e747d8bca510c03d1061a7778dcf","first_seen":"2023-05-06T12:03:53Z","last_seen":"2026-05-02T14:40:46.923663Z","times_seen":20,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/avangard_bank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/avangard_bank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-4bb\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6jGE6Xr9SmSDHka%2Bjm7tMFhoW7pnrR8kXRjyrve5heght3cqs0eHOGttbA6cuOIa2hPck89sToZPElHsFZCD4B5Ky7%2BnbY5hGjpdcOGWPbCovvE95Fcd9mc54zEXOpE%3D\"}]}\r\ncf-ray: 9e299b359dca5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1211,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"033f870547bd8101efb03cfa17a6b9fc","sha1":"b78c1217f1008002383fc769a84ef48ba0fbf6fb","sha256":"99dd819f073e7fe979c98de09626eb21fcf925fca8cb04c50f853af14d7bbb86","sha512":"8eef32a613277f6315b71509269256e11bddffa80fcc0495e6fc6c46b9a634b0418ef7efd824c403ea976ca6b9c8f8e8fa27914d2d8ec5c09f1bbed3e0b74d09","ssdeep":"","tlshash":"2d21022aa089982b41f9d350ebea499cf7794047c217d3dc71c17e178f35cb18507364","first_seen":"2023-05-09T12:00:49Z","last_seen":"2026-05-02T14:40:46.848289Z","times_seen":5,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-psb.webp","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-psb.webp HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3538\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-dd2\"\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y2evW%2FhXRCFYb%2B%2Br%2FHkc4oziT8M%2FwJ1BrYqBHBA96zeaph%2FKWDpGiwht4AOV%2FY0IaJo9gsZz%2BMT3dadxYbkjABEX11oAv0J496ZLAHD48UsBpmr09pBc6RnooccIe1M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35add15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3538,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b5a1046da492e62678cd4964e7abbe3d","sha1":"e6642ed0a5ba9fa040fc91fdee8d268167b9221a","sha256":"ed95df7e9411ed2f0d0c3d505512226d1d9adfa29308e86ec57f8d913e7feea9","sha512":"1e3db69758851900fe0abc02d6b4d2cc6534b67add94254613a80cae998af71346bf478bf67e84c86796d4d6f1b95a6b16e6db26fb7c0efd1e9185eb8a7dedd1","ssdeep":"","tlshash":"76714cc675818f81dc3e5739ec1a25f7816fd447b20b4dcb7711258906220388dae7a8","first_seen":"2025-06-16T08:35:34.407749Z","last_seen":"2026-05-02T14:40:47.006608Z","times_seen":16,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/volet_black.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/volet_black.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-1581\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RDeKky7FDQZFQVPBvPOJBUpqfo%2FbD8FxDGpFCS5AupoFMm94rKPSb2bsHMMjDDlLQw66iwSIlDk5IgtHcNamfHG%2Bi%2F4HtvUcaLg7wpp%2BwbbPRi4T6Rqd10WANtysdvo%3D\"}]}\r\ncf-ray: 9e299b355daf5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5505,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1bf2892736c12e2c8880973224d93280","sha1":"8dfdfff0d8dec7bfeddf9eb4024107699d8e8a10","sha256":"e2f4889cbc05dbd6ec133611035114961dace3fd1023d6db0b8a14dd0ce1c26c","sha512":"603d77e1f952ea41f8bf8e944d8c35d5144852ec5b695a0ae1022af46cb27256b906100c92c4997429a8452ad76ece6033645d5f6560df39902e68939fed4f45","ssdeep":"96:vKqykK2AaWlrfT3wirkuv7fAo95z6ye4q9Q9D4Q0Xhc:s32AXlrb5z5rzVqaDCO","tlshash":"eab1a4ed7f7052e58ac5e2e3eb10105d755fa0eaba218f28c25d9b1d388d47ced05e81","first_seen":"2025-10-01T10:54:28.637393Z","last_seen":"2026-05-02T14:40:46.948381Z","times_seen":8,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/group-120.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/group-120.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e416f-23b\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IEjTYRlzg1diV%2BHjnV6zd8sCh0e7Z%2BOjmUk5dxRS%2F%2BSP9CsNejP9M%2FbflRkalaeF0gotHZharu1ktvSmQpA5a77jz8bAS%2BP8u1Mh%2BRrQRM7oi5I0g%2B3LugAL6T9HHBc%3D\"}]}\r\ncf-ray: 9e299b39bdfe5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":571,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"24577ded8eb1487af8e392d46b5addc3","sha1":"b3171e021af5c868861469850bec20c049b17e0b","sha256":"0bb8dce71b9ce81fff2343340f75cf5b9d755664168c7de93321b274c3a56656","sha512":"4170d09e64cf35ad258c5867c2786bf4e876a75307ea8c6fc90d3a2c267dd9c3b05121d98ae6e5e0e415bb53f11b046f30cc960380f7a35298c284f30e45644e","ssdeep":"","tlshash":"6ff0509956d8482814378262ebc83dd4d91ff243424a5ce571ddf5732f364d4186f259","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.902405Z","times_seen":4,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:44.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:45 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I1HES3IBO0beN179ztjymyi7er4cn1uYfHSw4DCdkfktTDisuJA9Kos%2BVeOog6eaqsPOIHaQEAVBz6XmikpeVgmeTnN6EjucWHdXsr82FqP8NSZtDVzEcQJlF08ldsIYTCVUdwBGTKiz9YxW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b7708ca5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":1043,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1043,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/unionpay.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/unionpay.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-44d3\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iUvAKdbK%2FArrhupH%2FUC2JNDiutwM%2BRprpKcj%2FSSZ1p6zGiv9REemJPcjDqu0OS4p1BoIY2EruJouW2%2BsLInRsVSdwEbk8%2BUmHIcdHaynpdNuyUejnsp3ny4ZFALcWVA%3D\"}]}\r\ncf-ray: 9e299b357dbc5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17619,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"865d99d35a0527a616e18c54750d7cd5","sha1":"c81b83dbf5d8e6813e648fa582c00a47998f15dd","sha256":"0965c883334a0dcaa0db6a4e11ba56542c9fcbca7e952e0d73c4db9c7173d3db","sha512":"0b3f7d08b5d2f55cb819853b93b6d937025c958b8e0379f15403062af6ad1148874fa980788140b54c485a44073c7f5d8a99305edac0cdc1f80f8f2606053064","ssdeep":"384:0sywAIgmrO/OH8RFC015tycheSOBiJyTDRw+ta0FDhgboANIPIR:01wAXqLEDychH7bsa0FDCoiIPO","tlshash":"108209ec61638af2ed57f7df48d20052291a34bf7fc1932ccda5d5a978269e018099b3","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.996391Z","times_seen":7,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-wildberries.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-wildberries.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 41779\r\nlast-modified: Thu, 03 Jul 2025 11:01:38 GMT\r\netag: \"68666312-a333\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MMLiUBzcQom0nDYn39dCodFL5IWZsltNwj0nyIJ2YD4br0smkoAvZJmjXaZnYaqxNd4MkXpi1yKEwnS5GurGEJXSsV71xlpircoqi6YMBFUM%2Fp1aVglkFx0gacCxTWw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b358dc45fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1680 x 1679, 8-bit/color RGBA, non-interlaced","md5":"55e2197af773d7c961f9e972a938d0c0","sha1":"2ea94c6272c08bcf3bebafdceba2721a23daf569","sha256":"68e2ef14cb960b780637145e13f930c6acfd0fdfbf20d80a73791fd6fcab3839","sha512":"e28390d049fbffcc25f122c3a4030b74a446d7c3271fa620594706a40a9bb24a2140b1caf5eb7cd0e6b5b4ee06090a02b9a8fdca404b6396b4dfe14caa82d718","ssdeep":"768:XEydP+ZvCtrXD9uXIpMnTHW9yurumsPgLIiC1GQKE+mNFk86d:UydPcQuXIynTtoLIbxN8d","tlshash":"cc139e6ad5779a4de6dd8637bb1c0becb772610d4038db0ac6bc46803f813a99ee0705","first_seen":"2026-03-26T22:32:14.201128Z","last_seen":"2026-05-02T14:40:46.959797Z","times_seen":3,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/opensans/v44/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18640\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Mar 2026 19:50:52 GMT\r\nexpires: Thu, 25 Mar 2027 19:50:52 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:29:38 GMT\r\ncontent-type: font/woff2\r\nage: 96042\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18640,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18640, version 1.0","md5":"289ab8c3689e58c84c061039efc15d3a","sha1":"9432c99c4915ea17dea97eec0bbd0f2fa6ff0943","sha256":"0e44026ad31376af1b56593cd4acb4f353f8e8789c51759e18f64578e4ef296a","sha512":"4c0ea3fe4daefcd63f7337e7a8e86d169c0f4ce3543b12a69f9980a5bb598987521138454ad4df4474a1edb0fef0c38cfd2de312cb355c9c2665ea3445586787","ssdeep":"384:UubNl0SziXg7u9lPk6A/BViMAf2zAeyrmYAUXKb+cu5E0GW6o6:dbj0S2XjRk6A+MAf2UeGIUEbM4WZ6","tlshash":"9182d1454a3d7753f235a6425daef8cac2b5d42d56978c103be2541a3dff28e33109d8","first_seen":"2025-09-17T00:02:10.421759Z","last_seen":"2026-06-08T11:46:59.60885Z","times_seen":38825,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":64,"dns":1,"connect":7,"send":0,"wait":8,"receive":2,"ssl":53},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/replay.js","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:36.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /api/replay.js HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:38 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=14400\r\nlast-modified: Fri, 18 Jul 2025 15:11:55 GMT\r\netag: W/\"241cd-1981e178678\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QXZCYEbBEnpwqQk%2BfguTBnzn9g6a2iGgxip4fBUFZmrP91nwjhei%2FbQKHe50zkgigElTnoF%2BBGoNGPFwD%2BvVETYnf1p4yAk3rtuMPfwRlPXm5YsxTtvutAf88bPxdwN3DzYCmIf9UCsvhXdx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b424e785fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":147917,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (36987)","md5":"46835096cfb5871e759de48362600e56","sha1":"c656e837eafd1b4d9508618e5a3014ff3d0b1391","sha256":"f133ed85f6650eb21d4e5fa67065d995c1da84036ebb8f5bf8d4d764beb1be53","sha512":"9c1aa279ebcd65dbc4fc97352424bdb31f3cb43346cfd832d2a92ea84a61aadf0ca98b714290568368c76bdf4b460bdd156ceb0c35b3b23fdf2bcdd8e7db938a","ssdeep":"3072:fw9TErSdw8JJEiB7MiUxAYCFHLk5UbXcET7m886k:Y9TY8Jr7QxAfFHLk5UbXcEO886k","tlshash":"a4e328c931a5397367d605a8907a0241b6352955700c80b8f93dedfb78bac8321bbfbd","first_seen":"2025-08-26T16:38:12.262364Z","last_seen":"2026-06-05T11:34:01.17121Z","times_seen":89,"resource_available":true,"data":null}},"time_used":2292,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2246,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:42.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:43 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qd5%2BmdZMZBYjF%2FiekxDNzJxtTtR06S%2FhuUpKyE%2Bj5SeLYiwTTbSNm5SNL2ALF4jL5pUhcKyUeayAGglNTteSdyRfhP8CjF2tuFsk%2F44Nz1tCXqD%2FA68ugA5KIH803fFD%2BnTP9XBSBe7EhSzb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b6a886b5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":619,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":619,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-26T22:31:33.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Thu, 26 Mar 2026 22:31:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nx-powered-by: PHP/8.4.14\r\nset-cookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; path=/; HttpOnly\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nlocation: /en/\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tjj3TX6YZDvThjAgKW891%2F4olUQqi2DmIHzjm1T%2B%2FV3nAa7JQNzXrthm7CgnwFzdVv2gJRbDCkfokIBa282KHp2Kh%2FH1Br1cvXKZfubAPpExzM8FxVUKtDKaQQRPtGY%3D\"}]}\r\ncf-ray: 9e299b309e3cb4fd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":129657,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":323,"timings":{"blocked":47,"dns":42,"connect":1,"send":0,"wait":217,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-alataucitybank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-alataucitybank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 16363\r\nlast-modified: Tue, 13 Jan 2026 13:56:33 GMT\r\netag: \"69664f11-3feb\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0Bn7pgQZJO2LXD%2Fo%2F%2FMz4nndwZXvIW4LA8TdM0aI0vT%2FxxJqWH0%2F0mZzRH3BvqelubutzkUmFi%2F57gfPXi41m2rQIWp0%2F0LJmEdwlMxQjbTGchrk6IVRlnhcTD679Bc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cddf5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16363,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 240 x 240, 8-bit/color RGBA, interlaced","md5":"3f68670b5a78c189c563d0b896bcbe8f","sha1":"d4d786f60349202459b78debc85a4245eebd9b74","sha256":"5c9bf737cda20adc37baba113c289a88fc15103e27f221d2d9178de1f7740a11","sha512":"7534760e64dfdf7d75c115305449276ecb77302949f7ea4c78d57339a35880f08739d0ca0b4baf22c244c656b80407d69d26ac682e6994debcd6d8c7efe4bd60","ssdeep":"384:m2OgduVinY84rOXgjIjpk4cGNAORFvnBR:m2OggVcY8PXgjIjlcvOlR","tlshash":"5e72c0c5733f2d4c93cf1065eb0195aaf93980b4e424e862f36ac41e609aae55bf7488","first_seen":"2026-03-26T22:32:14.203882Z","last_seen":"2026-05-02T14:40:46.920902Z","times_seen":3,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-xaut.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-xaut.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 985\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-3d9\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6fJnrAtGAbcLbo%2F3anj%2FAUimAJk7eIGzd8836Nf%2Fz4W013spo6Eyl3aJBFtZgIbjFCPWpdzdoLsqMdN0QH5GpGU%2BfBSWmSahyoqJj1jkC%2BRW5wkmNjE0oi3GskVNsTk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b350d965fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":985,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"fd19a0d07387a341f23748d4782e4953","sha1":"d448191045762c0703ee030aab5284a61cf200db","sha256":"0f46a70092ed79facf7883fad2bf3a9a3bede954dc0516839f6cf82e37e2d8cd","sha512":"889c014fd7b15929629f18671e3aac7835f38db852d80a6c4fa6bfa56d0df95aff61147c809c3abfe2d6bfb6fef2bae0fe3dc53862d2ee251d538fb280851191","ssdeep":"","tlshash":"e711d53906e06abca89b2ea19847223ac47a8ca4caa00ab4226202033610d146cad745","first_seen":"2024-08-19T13:13:44.420636Z","last_seen":"2026-05-02T14:40:46.943032Z","times_seen":7,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-pol.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-pol.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 86423\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-15197\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eruKEGQkEuFnmtR6JTKSlKlnpDrRJ8%2Fgh39S5aFqqIZvuC8Ioe14jO5MoiY%2FWKeCwvdGo7RdOQaemoic0OYL6r%2Bz%2BqjCq7KmIqAhMXHFzd1%2BIK3FiPQBCqFSpzQLc48%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b351d985fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86423,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 600 x 600, 8-bit/color RGBA, non-interlaced","md5":"959c38437f1666071910f13231c255e2","sha1":"da1c9d31e3aad998d4174eead1253c4c0bc6bcee","sha256":"6aa8185c5c1e5b2d79ae8b9b444f5e95dbc6ffe805d1b4a5630497a55685f2c7","sha512":"e9acc1360ddf9a6e94390535108aa8ca7a89b573f800a8a699b75d57e2d6fac0ec141b8a275b92e1abce744471becb9d6912668ee4696c6ba831382e6958f3de","ssdeep":"1536:KquoOxYU9bv2xfvedPFdcAjWHuF0dohyn3+dAC2T1YC3Ryjcc6hp2BtAjW5COxc5:K7YU9bvFPNj7Fqm2JYChIL6hp2B2fOxY","tlshash":"e28302a966fd0638dbb79a73e1634f23487398910c213b78c95295548edb43bf6cd0d8","first_seen":"2024-08-20T08:31:36.318161Z","last_seen":"2026-05-02T14:40:46.94201Z","times_seen":24,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps88/ps-dash2.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.064Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps88/ps-dash2.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2263\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-8d7\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L0s6B5xqhFBsT4JxXZ5PHocJuL%2Bydkvpf%2FP2HsI6wdBPiNpAkrEDz4WmBdZJR8mvNCA3P9NCiAbSJKxyK3VFAteTnBegCQgUCrQ99vkp9a0RP6%2B7QXCCLTLj7OA0qSQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b351d9c5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2263,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"668602122338c27f5c9e69869513913b","sha1":"5433abc4d7e20358559b7b6ffa162001e4a63952","sha256":"a9315ce3d80716447ab6fb0d6fc6a22df17dcfb6f341bdf2843488d4af4024e5","sha512":"5b39a445a2b582a8b6a37600fb0153d1cf511fb0610f66cef94924fdd8344cc93f942005c0c62162eab1f29331a9576aa1a76c47d20acb93b9bdf028da2689a6","ssdeep":"","tlshash":"f74119f7e1aef4657da4a13203335284f4fa66214d0faa100907705e73f279022ae548","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.85595Z","times_seen":39,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-wise.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-wise.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 65270\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-fef6\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9jmkJyJZBA8Pjzf6qiZ62a45ZbDmsbC6NmPVd%2FZuKPyD%2BNqCuG9dhKiGXmte4bNL4ZDrNcYgWFw2RUPQUM5NPlkPmjRh0xfUYXV2qDzwRqw11U%2FE9troxDghITKu3c8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd45fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65270,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 401, 8-bit/color RGBA, non-interlaced","md5":"009af029e041cc0e8f9cd3d1ecf83c1f","sha1":"63369800503d76d56271de907fe7c7a9b0b2efeb","sha256":"381724518931b391f03d27e0ed59e09f968c2ba186069ca19cd83e760ffd8f30","sha512":"a535aea75c55750b6a127735fe678a4f14d50809580b5dbd2e5dbaa55d4e2b6c1d3695642906f901b5b4a563352a759ee068aad1c25f444cf9c0a0e9e93190b6","ssdeep":"1536:kqiZE0FJDlXXQ3RskS7s9wfH9CvDgxn+U/ekdAQr09FrkwMWFC:GZlTNOjB9wYDB5049FhM","tlshash":"745302f196e50aee16707399e9cc752d0fb0a0209a8ff176904d71817fa5aa61e0cf4f","first_seen":"2024-03-07T07:34:52Z","last_seen":"2026-05-02T14:40:46.871873Z","times_seen":9,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-bank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-bank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1451\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-5ab\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2FYTmNZOkUF7L2o2hMtuSZ88Cqs5lY6Mm34Cnl8f5hE7gXQ31rJxqlQMP09ae1qdNl4TA28l5l7g1UclUtVA%2FmRZOEszc7KBuaNt%2FVdmtbZieDzuOPDASZ%2BNz8zDiBM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd65fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1451,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"9fd2d6703e121e2cc9f3006f3453b576","sha1":"652556ec669414113cec75acecc0052563a18c4d","sha256":"3bf252aa3de00b707648fd20e45d3e66d8a0706d99843a417c54f70d59f68297","sha512":"cffcb08ab929c25511b8ebe14978dd7c1d0188583a1e4ac9ffad8296b09a4864fffde438bfb34a1f1947774e315fff85bd8856887a36675580cd37abcac51545","ssdeep":"","tlshash":"f831c69a15209abde8009e37e25a4114f27f48b580d596efcc8a51f0a0752a134c5056","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.933428Z","times_seen":17,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/javascript/?v=26\u0026h=S0JoZ0NJM29uRUhMNmJ2eG5VaTIzdy9RT3NDblpBM0R1YmtROVRTbHFmNmlhTDR6bzZjTituSldDbm1XZUZORg==","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /en/javascript/?v=26\u0026h=S0JoZ0NJM29uRUhMNmJ2eG5VaTIzdy9RT3NDblpBM0R1YmtROVRTbHFmNmlhTDR6bzZjTituSldDbm1XZUZORg== HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W53cNg81xzicYRPgURiL4sjRIlekv3ZLBX5ldDTy3wgoj18PbPy3sRuAZ%2FAe2EAAhY8tjorwdDQ3wuQ7gGLV511dxUjms6%2Fog%2Bn1Ck%2FuKPjgTqByy8aKpkw%2BOOnMuZk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b35ede65fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":113395,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"25ef1fa53fe4efdc3a000ecbbb456c9f","sha1":"287e2583b8aed94b7147c900b792c45553a9b687","sha256":"4a2d78c9751ddc6beb683bf406b68dabcb046ae4e6df544330f8baa8c1e1a4dc","sha512":"fefe52e50a6ea2d38ae375dfc8cf671f860e7c94c58b6881a035cbf3960deeedfc23425e9b20b922580450a3337444ad5d81eacda99fd61ab071a95396ceaecb","ssdeep":"1536:xs5E+aIGCsriNKowg+HaXcWB03YIg/cIgC8Zr4BWQyRcE:xseIGCsEwgaaMl3YIg/cIgC8ZrFcE","tlshash":"5cb372cd3992212546b3b33a8fbb8908ff3a952b055517197d8c95913fb081893e6fac","first_seen":"2026-03-26T22:32:14.212007Z","last_seen":"2026-03-26T22:32:14.212007Z","times_seen":1,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-crp.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-crp.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2565\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-a05\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BHq3JATRE92ZNj1Dk6OSFa%2Bbc1Xw%2B3mKtL5a8pKFok39CciA4PXP%2FpwaDR8sYgRBMIVtspTFvgf4LihBbliRaDkEPm8TBje8uc0XEcnlyYXXEn20r4hGcHEKI3AJgyY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34ed8a5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2565,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"6ef78b541a6e5198201393f95c6518e9","sha1":"a37089d4d984f4a09d5a8beb890a3c60596f6927","sha256":"a1b7382a550f420bd230f8b5c0e334a11bdd8c222701df0f2447a66d0aeb8d24","sha512":"ffba3afbcf39b48124dd9fc37a93a2160503d8d13df69c6aebd6c9235d5b280b705e23fbb2691626bf3377dfd8c547d170ee8519c76492ce0c962b5806af6932","ssdeep":"","tlshash":"4e510b03112495d54c110ab3667f758e5e1b1fdb4caab3a9282cb507793a5c8d43a709","first_seen":"2025-10-01T10:54:28.53418Z","last_seen":"2026-05-02T14:40:46.94104Z","times_seen":4,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-tusd.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-tusd.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1475\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-5c3\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Klcu55fpOXaNLfY22fZg14B%2BVqaX8ZxHgH1iaidRZ84vGSPpDH3nhzR5ZQD7wCRqqzBSaXpo4Rt1gcPO2QyP7gRS3KgM8qAXUw7if%2F60NDeTLNuh2s8URj3spWtNXIw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34fd905fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1475,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"2508f3647399bc8f88ade615e8ffff8b","sha1":"0db44591a5c55f1b88c310b75b5482471f9e789f","sha256":"0a7162f655a219c856567230f9681c39f9dc70dd719bdb65bdc2024e824f1444","sha512":"2a73aed59b0724819da8924e8256d4202c75f5157b45c46a27401cdd57a1873fd740dd19a9c9d287365d2fe3dcc7fc1e59b52d957c4f44af1bb010020b911626","ssdeep":"","tlshash":"9e31196d92bb5813b128a7a2db8b814048ce450e198b4a0b20e6c20f12c0196284efbd","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-02T14:40:46.89182Z","times_seen":20,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/stellar.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/stellar.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-c13\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WDtmfsG67XGdSHvCJLZsNVyViebQrWFwSjGEn6Yy%2F6YPyHqFOm%2F43CH6bB9qC1Segf3IoYMThUf%2BuxZ9GmYT3Hg9yejsYnzKkJI4gjOqAKg37NnVEyUd7PyEsMf0tsc%3D\"}]}\r\ncf-ray: 9e299b351d995fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3091,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0439c9946dac7f4af9c9dbfe51084fce","sha1":"f7e939d65c38de13d7647d742b04324b5c3584d6","sha256":"e0157b7de4c8e3a729b5168b1cedb177496f51e7f74a6fc99c3a064545164e43","sha512":"8a858f1e7de5e8c3c963bca2560c5d084006eecb234b7f7dd2646d5432e0162d91a77dc593e1e9ed47c934e2fc0e7ee630caacf3886a9bf80e3ea1fd56bec32e","ssdeep":"","tlshash":"bb513464e6191bfc480b07e48e284470365f50ff791383bca2699732b50bbe9d651dae","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.866296Z","times_seen":9,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/raiffeisen.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/raiffeisen.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-93f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dkHxSfE4O9vMgIOHInS%2B0vi%2BuH%2FsVLd93Kb2Bp0MewpKmW%2FCQ24zYb%2FU1TEjnhjVGcZy4jEfW3Iq2moWrO3ryG0z1L6HvCfAkuI7%2BUqUKV%2BwDPNpV%2B4Jk%2FvfBPOX0ug%3D\"}]}\r\ncf-ray: 9e299b359dc75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2367,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6699e01ef358694172d90beb88adecd3","sha1":"4f052d88854d72c74ed768bbdf02b841f267e85a","sha256":"e1fb1f169b5ce77e6ed3d2c072ab2456f34f78009369c0cae5c6d2ef77417bb2","sha512":"251241effeb44db8ecae56d5d96161ccd345c07eaa0f2ddf6f661d6ae56bbc1d19fae77d85aadca236b16f11fd5492a9f8325a28813e0b75210e405d63520c41","ssdeep":"","tlshash":"8f41749c53848cfeda1a93faf3e568c5b192029f83e166c4b2d72c430b32d98090e59c","first_seen":"2023-05-09T12:00:49Z","last_seen":"2026-05-02T14:40:46.974467Z","times_seen":10,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbWmT.ttf","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/roboto/v51/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbWmT.ttf HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 74698\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 26 Mar 2026 20:45:09 GMT\r\nexpires: Fri, 26 Mar 2027 20:45:09 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:58 GMT\r\ncontent-type: font/ttf\r\nvary: Accept-Encoding\r\nage: 6386\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":123720,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"GDEF\", 13 names, Microsoft, language 0x409","md5":"dd44e0fc642bcee526f88d872435dcbb","sha1":"e8c3ed69f489ec5c2de017b1fcbb1990535fb8f8","sha256":"dece7c71bbe61710787f0839c722c65e87355dd2eb4a823e6b5488121ff81e4b","sha512":"f22335e6dc6130acf03634a563b387184af8c64fc4115f1d72d07ca40418a7d201d60ab101d46f616b8a6eff6c9c0b9bbc030351c533fa203a19ffd091669303","ssdeep":"3072:opNiBBBYBBLBXAxkT5IvkbIE2qDe/7u27dZEzPczx:5BBBYBBLBwxkT5Icbv23/7z4z01","tlshash":"1ac36c18e313ab98d93063bdc853e3d16aea7818e7c3831b246db7b659860dd5df41c8","first_seen":"2026-02-23T17:03:58.108687Z","last_seen":"2026-06-06T13:03:00.213757Z","times_seen":167,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-rnkb.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-rnkb.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 2709\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-a95\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C%2BjLCkFFE1Oi6lQJLjhNun0%2BCasrkX56upr2ZZlavau6mnVx3Fq%2BejOi1sDP%2FmjL7TDB5WAYa5mrbAsfrIOdVo8fI3hANjHYKY7ocIT6Ph6fDBYdJec2UqGA194HaHk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b359dcb5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2709,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"4b811fb2eb91be9d06d87757cdfe083b","sha1":"128dcff521ecd5438e3b7ac185a1c81ce1dfeba8","sha256":"eec72774b86f182209f4c1432df0f4cf45eb1e7407bc42c300f1ee0875e9848a","sha512":"c16e80b834e1e5aa072d8e943c3f00dc15a2ef460853cf09f23bb7ac64c1e7b07f4054131975d0f74cfc9b55df2058b8ec15ef2062260337efdc09886d6519e2","ssdeep":"","tlshash":"5c51a3fc31c3880de553ea1b4b37f220d6bb8093253316675c086f160a3a5a9cb63d4b","first_seen":"2026-03-26T22:32:14.219344Z","last_seen":"2026-05-02T14:40:47.009574Z","times_seen":3,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/js/_custom.js?v=26","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/js/_custom.js?v=26 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Jul 2025 10:16:17 GMT\r\netag: W/\"686e4171-db\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WmRm%2F1TQmW3ChlzB4AZiHFzvmjqo6eGXbTm%2BN6plzsPkwy9XWLddzKgNjiA49gf6AIOqemecfDvilLCOWcw9uEcwYSwQvx1v4Fqhn92DuDxBG01eijrEMPPc6YHBSGs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b35ede75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":219,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"678aa29bb81d2e97d0bf70359b2126f5","sha1":"e71fffbb1cb7f20fbff68fdfb2c6b111d48aed44","sha256":"9119e0ee6a86b2949be2202ee7d40213b501c10536b8c493de39bd17509eab3c","sha512":"3713de7b562350224b7098bbbadad353a70b423e37bf44f4acc0c9e31ffe66adfb183ab83382ecc9578e0644106b2678a4876d8bb152dc73787bfe124445a602","ssdeep":"","tlshash":"9cd0a9d9210f29300abbf23abd2be20dafb2c0223001a946b80502800cfcba00037c8b","first_seen":"2026-03-26T22:32:14.220672Z","last_seen":"2026-05-02T14:40:47.001871Z","times_seen":3,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"POST /en/ HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 152\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":152,"data":"action=http_access\u0026in_background=true\u0026url_from=\u0026url_to=https%3A%2F%2Froyalcash.cc%2Fen%2F\u0026queryID=1774564294824\u0026callback=\u0026query_version=1.1\u0026url=%2Fen%2F"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7CK75ggS4unrssenj55XOMW3ujIpwNyBQ4Uk%2BHClhJhOFTsxoKIFhGJyxdtcrFgWq6r0P89AQFd0yz3co7uv9YfSDi85EH4So6RriqRUCPYpwmCzgjgjo8Zy%2Bq7h2uM%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9e299b3abe075fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":147,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"63cec60a0e73fa78e5f80c086f7599f8","sha1":"9f774549ab72b65bef710bf27e7873d17456408c","sha256":"0c333613c4eb86c4939a383059b61167967170eb8f3a71d3423b4919d0ad222a","sha512":"88d398e34cd474abcf072f466903f2b1c951dd20d158e5b688aac0e80008d235b1591a1bc124d14c2124c730fdfa29bef3167ba47e01f5e441ea0f6d8d421e85","ssdeep":"","tlshash":"aac02b401ccf0c072d29e30005032a8000efe1c7707f1d88cc54c90010e800dad039aa","first_seen":"2026-03-26T22:32:14.221932Z","last_seen":"2026-03-26T22:32:14.221932Z","times_seen":1,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:43.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:44 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LwsKudR4zqkLulXNYwMOcZ4n3IyuOV0km%2BBlyPs0kLegr3QnvRED04qUGkW898e%2B7Xll060BUBkHrBqWMyTrcn%2ByjJktThdC7GL%2BOoj1WBxyk%2FWCcBWbXBgPPwVudj9zn05E0cEscEiz8Fhb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b71d8a25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":1251,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-paypal.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-paypal.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 602\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-25a\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2LwDBw8P0E06g0aUHf13rKRJXrmv4U5bE%2BhY%2F2OX9idpivXhDQE8OY634PiUew9NN72AMdKDl2sO2I2jHynVbPGbLacDPMu0AM2KOeCxT1Fejacri7aBgIGrnbaizKU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db15fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":602,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"9fb32c1095e92855c702a20140635c31","sha1":"4d04db73680fe45ba1df3f168030b7275ff5a4eb","sha256":"f6b9ca0d5d68d1328c56db4144882fe493d70c4ebc1aedd2e46629e0db72e8c0","sha512":"05074e3dc59739e84a2e61bf4dabefcb65e2a61ec1d1b66716068a5cd99457c89c072b759d60679a8a7b770af72d13c34f91c8c63e4b6f5afcbf0f292a3fcf8d","ssdeep":"","tlshash":"a4f047cefddcbc3e935675239536c641f4da4f149446e4432e199f551c4f8e688d4704","first_seen":"2023-05-07T20:18:14Z","last_seen":"2026-05-02T14:40:46.845229Z","times_seen":24,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/ruskiystandart.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/ruskiystandart.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-13c06\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=enZ01BERY0lH1l0rZ8eeQ0UdcDq%2BeL%2FEy%2BQFbmdLm4KlxgtpCFSblXIKckLRRVRHlON1GiVA563se4VBoBQnVXviUghCBTne6vDTraGgYc4PdvfBZtz2GWtILzojXvU%3D\"}]}\r\ncf-ray: 9e299b35add05fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80902,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bfb1916f6fa0ae61754fd20daa10bd7a","sha1":"188fe7bbb21b5c5a0bd3ddb8d3bb757f736aef3f","sha256":"9eb308bd4b699ac51136c3969803fc3ef25ca9c3e3c525e6b65b9d3adda54558","sha512":"2ecbe9db3b9305b0c4964a87360d45d205d2c7b4a322393e4f952fa9195b299bea8d1885fa53792b914bfba2b8f19f275213e3cd8b3379dbabea7814ca4a71f6","ssdeep":"768:hQO4JiuUnJCeVMr2yzYNbSHv/NpEWwfV6K:WZYAEW2","tlshash":"1783eff583c9d571ba4ded580d3a3e35229238bf4ee2294d026a7189e13bed33b54e41","first_seen":"2025-06-23T06:58:58.963698Z","last_seen":"2026-05-02T14:40:46.960966Z","times_seen":5,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/down-arrow.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/down-arrow.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e416f-1a9\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VeaQK0z%2BjqmPMTMBS5nsSi65B0f5UkNZUdTfpOF%2BQLXu2zBNruaU0PXz0ZYvkCWPeffockqv%2F1VL6H1OHJfckeemMWBWcD69K8%2FA%2Fd8QJCYfGJd%2FpI2uw4oUSuzzhCA%3D\"}]}\r\ncf-ray: 9e299b39adfd5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":425,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d7b0c05de1f0e6199685b9bbd263b9d9","sha1":"d5287b62a00936b41334b6671dbba14645e89a2f","sha256":"6026e4dadaac347fb907f1585602dfcb4d6528707c84709f5c6598e4a382610e","sha512":"0861e126062ec1c7350ecc50b0cd3c9ac23110b529a9624a16dfd4b35602edf027d0a09e7d5310ff0157e3636644426ca89b7c0ba71e94662b656932767df92e","ssdeep":"","tlshash":"6be0f14b4680d8e45862ce2ced388006a61dd86080d8f1c4e4e22a3bf7691d0b38ff04","first_seen":"2025-07-01T05:34:38.224244Z","last_seen":"2026-05-02T14:40:46.96269Z","times_seen":5,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/wschat/dist/client.css?v=26.1774564294","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/wschat/dist/client.css?v=26.1774564294 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:35 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 16 Mar 2026 14:40:55 GMT\r\netag: W/\"69b81677-392d\"\r\nexpires: Tue, 22 Sep 2026 22:31:35 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PeCzGQadZcZttQIgW%2BjsNFokL5A1eEbcSndoSxmM7wkce62tZEKY52JX90g59ADwVevRzkwE5raglMeQUK61TZT6%2BjzhUREpXUPurMJDrpXqdIY7M07pQYjgwzIA0qk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b3c6e105fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14637,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (14635), with no line terminators","md5":"f12f0e14c7a7141ff91965e622d7d3b8","sha1":"a8eb71cb56ba24ab56039dc7d69db21126acdb18","sha256":"e76d1c83eae845b3fdf3bbd76b93a7cd3b6d99e778d66e419a39f1c144f57064","sha512":"227c7d2453cf084a644eee7efa42750d763e8c6841d1d68a224ad79a73327f67a002ae8d9ea1abaded84cdf16e8a4e482af005e76db5e4895d9b6deadd02f1b8","ssdeep":"192:O8MCgciePlRTrfGxJmuUPlh1Ezjbju1CKemVHeYOU3KJLWFcYbMpEp4w1:/MCgctP6Jmnc61CzGeaTme","tlshash":"e6623272b958301bbc9b8c7b758467da7121b006b22317bbf91c7574ca864eb2223f74","first_seen":"2026-03-26T22:32:14.227641Z","last_seen":"2026-05-02T14:40:46.978079Z","times_seen":3,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/select2/css/select2.min.css","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/select2/css/select2.min.css HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: W/\"686661f4-3b5d\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SkZ8Zuiarb77kB5CaDj9VSSz98CdJpOtVcY5UfVL2qxABZ%2FV5rnQJtY0h1TUud1WKTCL2509%2Fl78gwv1vp%2BUFXyjZGJON8fdHlbWtTZN53%2FuBoHd1%2FJ2QrGYCHtgzKw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b34dd785fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15197,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (15195), with CRLF line terminators","md5":"1f0229f4a835adde370c8490b5fe5fc7","sha1":"bdee15f32133330e77e22784ac6d8f60d02fe59a","sha256":"ea237985427db5573da7d02e2ce688fe2337a308f9a08dbd73697430f6bc0aed","sha512":"c1cc2e691688b833c8b2c089cb02c001ce6b2c8994259ecca845ad527eb63068f184e9b2a6b4db5068f70178f21bb90adff1d1b12938efad75581f841e5a9bd2","ssdeep":"192:pL5u/nTfc3aqWJCeQ9CPjOtWlUJKLJcH9tPOs:3u/TfX1TQ9htWGSJcdws","tlshash":"a562aa29bacc2235b0bf8e7f6cf274946739dd5fc4111b9ab8e9e554c8e04540a8b60f","first_seen":"2023-04-07T07:37:47Z","last_seen":"2026-06-08T05:09:52.351258Z","times_seen":880,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/ethereum.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/ethereum.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-bc1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2F5B0%2B7YJelY4CQ0Fivd9FCYkGK0ch6p67ff6wkLTW%2FAdLgAK5xbihdZQ3azqHbFaQw9XKsDrk6wadfEemjLKCNl6bd3UMCOCdeLV3RV6BeSeT3%2FhBpFzXjZhcmIsYo%3D\"}]}\r\ncf-ray: 9e299b34ed8b5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3009,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"26ee68a66329e0f48c8b67d697826553","sha1":"5805e99a8e9dba6b290ac10e7db4411430c32275","sha256":"703bee2c6c20ce4d45fe7e0915e09cf11d2613569cad458b1eba2bb48cfc9cad","sha512":"91ec018971b2f119e90e33c10c9651e05778f08028bf870576c9d12b0962e0d798c4feb4c853fe48c0d3c500f60597127ecc93d0a54c8f28ee8c9875431efb4a","ssdeep":"","tlshash":"db51ffaa93d80c76923a73f1e0e849c1baa601d78792da44b19b68cb4f23cd9148f655","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.853716Z","times_seen":10,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/alphabank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/alphabank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-78e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WSAJQyRFfl0zjTPQsfIlfzDmulQ3OWSLoPYaY28k51ozeE1PTnqrTFkB6haTfsH98V4OUIQvkevD7VYIgtR5x4N0ShmNqa5MAn3Sm3M%2BWY2SJ848TYp%2B%2FuhSv7rkflM%3D\"}]}\r\ncf-ray: 9e299b358dc35fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1934,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d4f318d54bcdc9a1c9864acbfb8d04f5","sha1":"2d56c43c1666d521b468026f06f30ecf704d45d7","sha256":"cb5dfcf44da2e5e6d884394871bb20cbd95df04f10b82d3501641d8ee0eb9483","sha512":"db1a6371d3d59ca9f3ae03ea324a5fee40306788bc83190a4c6dd68694a1f5ee37a88f7d682c6b0f33edeadc71438d0406e425cf08be77238abf04b8b31ba563","ssdeep":"","tlshash":"f64124ec43d84199f44d53bcfcaf0da12a9164bb56d26ccc86677007c432ed52b29e49","first_seen":"2023-05-09T12:00:49Z","last_seen":"2026-05-02T14:40:46.944022Z","times_seen":8,"resource_available":false,"data":null}},"time_used":187,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/telegram3.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/telegram3.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e416f-4f1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9C%2B7kjzgUxlwNMrhTxa4LxmXPvHBXwz3Jx%2F8uIvUs4momg6gfihUL%2FYuzh85XvSvxHeVy2ZWcNS3LL437Ymk%2B2p6MhJFrf%2BwElJyBk5EDywzQwnW4bezvlwaAh2lDPU%3D\"}]}\r\ncf-ray: 9e299b38cdf75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1265,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"32f7eaae32917ab9d6aa8038fff52310","sha1":"dc674c758300b05cb6a21548029b1d4c71d777ce","sha256":"21efdb1f30422592a3fbff901d7fbb2b55714ded4241d2338ce559f4f98b7afb","sha512":"85ec57d6b4609317a84d5a7afa2ae58802c7614828987c66367544868da36e0a63330d32814b94b5965a4b93892ddb1c6b35be4b5c67f488041362411c5d8e7c","ssdeep":"","tlshash":"cc2102e811fc09dc6026a34cb352d4858b9ce0d7f3218046334eab364f26c50f61b120","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.90456Z","times_seen":4,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/css/main.css?v=26","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/css/main.css?v=26 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 04 Feb 2026 12:45:43 GMT\r\netag: W/\"69833f77-1bc5e\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qkD2qUoVdjfNSDdIDhazOX1v7NorjmBG2YhbmIAQSUda2ebJMPF8vddOpsOO%2Fa3eznz%2F%2BmeBdJlMu0WSf9RuyY4cghHbIcxRs3OounDZ3JYgZfVlQQIX61POEwhuT3M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b34dd795fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":113758,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"4efca1bb3d258e939c7b20293617e58f","sha1":"bc205424d6149a30639683a380a2c7f22cd7eff5","sha256":"3ee85a9059955daf416a8cf220d5b72b46dc7ae337a8cec22c0db2903ef60299","sha512":"94a0e598f39b8d6b6072a3b7bba9474dcc9adc807746129f6155bf80d353c31bf322bc97bc1080ee52d1a7ba1a7e06188edcb5d1ef63f1585e96d4f274ffc218","ssdeep":"768:uioFNFd+ghtQK6vrbQBud2lzncSlvGJA6qV0687vTJ/X49OmGJ5kUgjNxnkSw+uc:uNNruwl0+dL","tlshash":"25b35669d5142209a533dd6867962b21a3e8c473c70b53fa7ed29408e3c7a4487b6fcf","first_seen":"2026-03-26T22:32:14.234471Z","last_seen":"2026-03-27T00:02:01.873023Z","times_seen":2,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/bitcoin-cash.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/bitcoin-cash.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-3c4\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DzEAunVYPHPzr%2FKf0aAMMXKSOaPX0NfxT5AW9x3BqlS4BVCSjPXSkmFcrwClfvZodckSzZ%2BWEI7FvnJTD059xANjVpxNhrBHgPe3WklKN8sJtf52%2BCITpPI%2BZo2qZho%3D\"}]}\r\ncf-ray: 9e299b351d9a5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":964,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"52f348b2794c6a3a651153db24a06ec7","sha1":"cee262d1c84d2f55519cb979e0c0a54b5e06d666","sha256":"bdbdb26cff7c466ff156940baccbf21642f44b045c9eda02d108e2b3944e1f96","sha512":"b4c61df3c718769e143e7d830ff8295820bab32964b43593519175629a58a3629981a4ed759d2414c6a01d6678792f47ef6114fc2a1c20506009cc64baa563b5","ssdeep":"","tlshash":"d41165d72354f8c8c99388ec6f14a8d21c2170ca59ba24e6a58fd90cb50a9cda600858","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.946673Z","times_seen":12,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/cardano.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/cardano.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-1017\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vSlLMNVA5NosW5WaTLKlmBwe83db25wCEpCOBIUCuRt%2FoaZeOC3o1BB%2BpcFWZKnRu0IjxgacsCEZmNmEiEgIfcZMYMADHz0UzTiufr3wECgVHgIWyJajQgxJhK8j%2FgY%3D\"}]}\r\ncf-ray: 9e299b351da25fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4119,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"76e929a441734ae92e140be3a3abd791","sha1":"ad2b1ac9d77f595d1b1701aba8043a58b500a72c","sha256":"d4c0d1cc9698225117b8b3d60ed88b125a6096aa10da78702c1a551d836b3190","sha512":"080696ceb91c175bd13259573113f847564dd16f9baa50651a1135ba6a594ee3bbd79c92ae197d47eb33b22e9c24e41082f6b104cf505e5bcbf18f862b5788dd","ssdeep":"96:fPDrBksycbexGKtntaU8zIx7RNmgkIEbRRptXwTPkGOnoK2ch:f/mEexGKttp8ze7/nENtkkGOnN","tlshash":"03814049fba557b8ad4603b9d43056f43e4f80adfa02a37cc27293b1b10df9981c44ad","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.93025Z","times_seen":11,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/mir.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/mir.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-75e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yVuq3nxjnz8FwM8YPeoi513vD%2B1oqatLKuLb1R2pfJlnShwzjD%2FXx%2Fag0pY5%2FeH9jtp4McBOqAWU91Xn0POmJSYaTCjQfDG%2BqYrr9NvZPymM%2BZ5hAOgVwgAO6Ki3F5M%3D\"}]}\r\ncf-ray: 9e299b357dbe5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1886,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7d8558918365dadf1c69d8ece8c2f831","sha1":"5db1755dbeeec739828d408970ca299bc6633cc2","sha256":"ed551ff46252e372677f3eac044a27f43afb20c5cee65c8128d4fd10da4590b3","sha512":"a4ee8048d91410fd80962ab3e4c7a1a6748219c7eccccc29a8ce7c51ad63028dc52c7b8b1ce1563aca4ad6987348e2093c2c0b2e23ff123154025f44f435aa3c","ssdeep":"","tlshash":"14411f75c15a181ba133c678ade4628fd3b12087138142457fed2ef99f745d7a38835d","first_seen":"2023-05-08T12:19:08Z","last_seen":"2026-05-02T14:40:47.003144Z","times_seen":9,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/visamc.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/visamc.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-d62f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oorWkoX0AWXKVkqAKluOSCyLwqy6bzxe8y3NxePhb2eVNWXU0xi8o1Broxr21bU3svLzZfIZnPsq46beKY9onlTzERV1RaEwlC6AUAKdALTtZlB078pgl%2Bwr%2FbxGwlw%3D\"}]}\r\ncf-ray: 9e299b357dbd5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54831,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0ddd3310f52fdaed12d567565026a719","sha1":"c1b9dab4cbb8c3ecb4943b5c11c6740645e04eda","sha256":"8de41312a61c98910ff90513fbebe383f15ade657945a15a4c534ad42503ba0d","sha512":"1c8165cb8b4a264d051fd07a6f79c3ea65c02bdaec4cb77187353698fb2ac6834a8e32ddd53c911ddfd4b0aa6962869e6f4fcbadc9ef4330a4a584a534e96366","ssdeep":"768:hQrcBjy8EdX1tRwoRPRD6ugGJ9vuxGSs3yJM/NIys6H2JbEGen5:Ww5yJJvRPReugrsRFRl","tlshash":"353372eb5378e2d9378f61c4bd25799d28e9387ae99971c8e0c3dc47e811af0840ae45","first_seen":"2025-06-23T06:58:58.985647Z","last_seen":"2026-05-02T14:40:47.019991Z","times_seen":10,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-humo3.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-humo3.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 9036\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-234c\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fmls9DxjaMiWEG6OtDuffPsOfRSfU4%2BmFJ8ShxHVapbMMo07sgwo9DY7DszW1Mey%2B20ACc3%2FaMo5jxSSj7DDedOynTKv2QxydKhiCu2IhCzqYxaSELSQyX5vfZTDM8A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bddc5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9036,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"aa6c4de04aaa8680bbaa047c6bbb053e","sha1":"1b7e8760429530d6d539d18c75235811395cfcae","sha256":"f0f7a42b7b8166556460b6072e741ae226cda432fd84a9f0ae7231cd51c65c95","sha512":"d8e65bad665af124152d0f6a207f51d076a6cb0b599529dd4f9260f3f0f96faab8fda06215b6c9cb6c497234a93c0a79cc51a6c8248bd7a91fa0951e05e51f0f","ssdeep":"192:tVQljbuv8DuTiU0uT7Hu8CzbMIFSQyCBGIsYgDHLrrBuy:EVCVT8k7O8wxFTHgvBl","tlshash":"08128e84ea92fb12a6024ddb3e1247603470150bb9448ba9075ce96f4d50fed2ffd67b","first_seen":"2024-03-07T07:34:52Z","last_seen":"2026-05-02T14:40:46.947198Z","times_seen":9,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/en/changes/","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"POST /en/changes/ HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 231\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":231,"data":"action=getChanges\u0026currpage=https%3A%2F%2Froyalcash.cc%2Fen%2F\u0026data%5Bcourse_init%5D=true\u0026in_background=true\u0026vri=17745642948240\u0026initial=1\u0026queryID=1774564295091\u0026callback=%3A%3A17745642948240_1\u0026query_version=1.1\u0026url=%2Fen%2Fchanges%2F"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\nset-cookie: hash=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GwPaCq9A872l33gqX3oL1mFp01ZGCahXIhGteIFiEspjhWUTaJ58mPeSR7Bk78ChoYWEq371mK2kvonnrZio8G3xQx5U7T%2FLE3ASu6VNHO2QPV7%2FM6x1Iju5hY27lXE%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9e299b3c5e0f5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27470,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"25d4d93d43868ce399ffae837383e012","sha1":"696ba87ab2ad9d35886dd21402ad2546451d4a27","sha256":"ea41b5ebd2d467a01e676de943211903016fad46d954d1745dee32e01cb548d8","sha512":"8bf0159df2588143e86249dd88c46e48be79e01387fb63a5f08191c49d29f420abd76cb8def53cafaa27a5075150cfcc713c45e5386d87ae878ef13d098aac33","ssdeep":"768:Dyil7zUObx+VGxTau6aP0wE+GyTYwJLSJpxOc:Gi5zUZVGxOpROLGZ","tlshash":"40c2322f767e7338491088f038c2bef9feb5644a5d8e8ea0cc541f5800dde7b99a9165","first_seen":"2026-03-26T22:32:14.243309Z","last_seen":"2026-03-26T22:32:14.243309Z","times_seen":1,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/cancel-button.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/cancel-button.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: REVALIDATED\r\netag: W/\"686e416f-36d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KL7CqWGq0MMqa9GWRcE1OZlvrXX0XmOWEzdG6Vf4eik16syzNFg2LhPbuLOIRYmTs3LhKSQiZqJwjEvCzJ8XtFdKqn1d7dwzCBF0pOj38kVmr%2F2xxwxPcXOxtJd0BZU%3D\"}]}\r\ncf-ray: 9e299b34ed855fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":877,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0a07f9813213b5353f165f8af89cb3ad","sha1":"287dfd901f7ca7df545c5af409058faa706bbd04","sha256":"1801fa1bb4b2a01ba7cd76a6f75ddf535c099b69027f299b4e4bfff3541953eb","sha512":"8d9ed410c7a266547c5e00eedd388ae0fd5eb96de002e81b91d2c470341cb4e6ff394aeb3cfa0144c4fa53ec07f6244215db0ba371e511b5710c5ce52bd431a6","ssdeep":"","tlshash":"b2114cf572f8435ca237a315caa175209b1ed17771078051f5ad17794f23441fa87c25","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.888058Z","times_seen":4,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/tron.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/tron.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-764\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yub5gx5nRPrf35zARxRYlhy%2FYChuxdAMfadL0DIB5XWSZUTfo3UWik4XdprZoTCwnSEbNdVsH0ZxmgO4KTkUahFDsMBiRdenwSHS0jdyzTiIdRdBrxoCj6wz4QHehTA%3D\"}]}\r\ncf-ray: 9e299b350d955fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1892,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a36c7c9a665311cb2bf95bfe8a04ab1b","sha1":"6e2fff958ccfdae1a80dda2a38920de1b8560b84","sha256":"83788a2767cae0b863b254a30d8c643ac03146eecf93b75ff92077cfc68bf9f4","sha512":"902a0e682c9e1f2e9ce37704711cdb6ecdc70a6cb5d42ae69e12356961ad5194d1a74a9f3cc6529b80fd4debddc7584a93d2ac4432adaa643d2d456831dfa166","ssdeep":"","tlshash":"ee41cb28c304c374dd56c3bc9f3968b4644e559fa1e1f7594ba4c6a0b2e50eda38ccda","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-06-01T23:01:54.964557Z","times_seen":16,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/capitalist.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/capitalist.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-26cd\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cbWhDnSC%2BuPlsz1sNHokAGou%2BLXCWLpoZg5csFxBAfnsRq93LO9uixe%2BrBRfBgZzOzWHHh%2Fe4qa%2FRUqwzb3vMBs56KWtA1PLxX5aTIOsgPZLKL1vxthYuHAzV9mt7G4%3D\"}]}\r\ncf-ray: 9e299b355dae5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9933,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"de343b41464059032ae5a2ad7205c266","sha1":"5721363445c6c070e724786b45ab569fc7b5f2db","sha256":"26d3b41b6023f480639e965ecb87d27ea1a7b69c40d2a39f42ceafc83a1dbdd4","sha512":"1608e13d14a29d0bc8c83f3d7a4d9170f5c856d57fcd26a01b44faa92ef8b90b551d5ee8d6d89274472fe663230128777a8ae99efe06d3d475673f1ac2c72d06","ssdeep":"192:hQT39RJ6TOaOHkNqg47C1EzC2+j3TcknmNjPIJSvYbdKIZxZHAh:hQrgzNqb75CdTcknmNjUxbUIpgh","tlshash":"8f2201ec83c845a9fa5e7364cd7b1de12a8328bb5ed158cc21eab406d632fd11f2d944","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:47.013727Z","times_seen":10,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/logo.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/logo.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:17 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e4171-1744\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cLwXu%2BQ4l9FhNbqOsBHCI12U90vOLm5VyE4PNZr9cRHu0jM0foeHJ7VsFlHvvR9vSP1s%2FDMqVSd3UBdo4XbeaQu2HaNhdwlYFuwthKb5GLr2lTfU9TES74CGvTqCIeg%3D\"}]}\r\ncf-ray: 9e299b34ed835fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5956,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0d07e9c0905c062b0f535e7a82ca161e","sha1":"21cc0ff8acc9c9db680899e39ecd927934973014","sha256":"3f6a536f004004b4e51862f11ee6eaf1d2c86effba0f897333e0783531fd10a6","sha512":"7cb105c5b910bcca0cd0e605a6e5d937e48a55a2bba7062735290cf5786a9f896810db2d9a12674b2b2b0516def7eab32ba3758d77334594114559cd7ed0b4ea","ssdeep":"96:alOf4G5DFgVYxeQyN0jE3T/1dWBU0BXlngDMkGC1ghJtHYHqxSvV4sBQ30H+y:H4GtFgIeQnj61daU0plngAkt10tHnStd","tlshash":"49c1f0474350cbfaefe9452c5a3428897ad1ecaae470d0c8e7ab1016d04dcd4a5ac7bf","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.940008Z","times_seen":4,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/gazprombank.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/gazprombank.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-1ce9\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6bR4EicT1Zgba3KLK%2FpVV4Vq61OJjqSwnxj9bprYS44Ab5Pr7Pq1oP3StDWqKg9hudBa7Vfau8i2ryNX%2FJEa30st3Fme5CiyTwKtWQ1RFnnigTRk1rdgZpOMY%2FqhI%2Fs%3D\"}]}\r\ncf-ray: 9e299b359dc95fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7401,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f92c8673b7516fb4939b8772bb28c595","sha1":"5935115b23685a48f0f3bb496c0208154dcf67e8","sha256":"dafcf254afc43a76a7b0aa692663eaf840796ed6670f6234cce9dd9479cbf40b","sha512":"62de79bc963d75e768292dd00bd7f473494f0767fa1eff888ac4a3be560ec153b9aef00a9a5927b137ef8a19df554dcb6397a9665e145c3706ab16a5f56ba8d8","ssdeep":"192:hQCnpcMLZTtu6oSLDz0BbvxWLWAp5cN485HZQ:hQkp5LZTtuFS3z2b5W35k5Q","tlshash":"55e145ea83e8c1a47d4e7370dd771af57691607b4681eccc12afb805d472ef02b29949","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.890016Z","times_seen":8,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-cash.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-cash.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1543\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-607\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4J1aIz0X8E8kPx4RicnW0w5uazXlO14dA4KcP7XzThS09iGQCZfeaP6f9ZEQi8Q0aBib8v3mCPSB0BQRAQHXalrpsMr1%2FtUegW2DSAgYosG1q2QSpEZYwzf6QekdF5M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cde35fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1543,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"397bbac12d25fe6f333d324a549a2b67","sha1":"e35c77024e5b0b530f8db1e05dc8a02ce66bce5b","sha256":"c0e6cab29d54073eb0f9d1317f47e52a12b2bdc5735601ca92002edf87aae6bd","sha512":"7eee5c31f88abdf960b1966fa13d2e0da656dfa002dbaa8d3ad3890f082c0e6ca073af1385a7995ccadd0d5e5a1d8b38a459da78263e747508595c77f501ef06","ssdeep":"","tlshash":"d7310ad0b308d8f51a9cb1c3413f1fb0de1b18a213b23954a4c4b6b58184da807eb79e","first_seen":"2025-10-01T10:54:28.414713Z","last_seen":"2026-05-02T14:40:46.851078Z","times_seen":14,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-payoneer-new.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-payoneer-new.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3870\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-f1e\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d%2F5YC66qs4Hw6IJG0k875bpVixn9b5GSioE3gHsiMngL6azP3QQNMcStxdVa1uJ8XbrtFFvK3DoT7SkONE1mnCb9P2L5uer9ZFL5VPJICRlbIsnp1L8CLttUPnB8Fbw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db85fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3870,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 57 x 57, 8-bit/color RGBA, non-interlaced","md5":"02fa420034bf9e256f646f68f1f3640f","sha1":"42217c5e32e36c3b2e242dca2e4bd7ad6b7a269c","sha256":"cf8f9251eeb1f0daf26dccbe262da3bfe40c32f4c953f8cea983608e563d8931","sha512":"3af24a396e8f462a9ea89319b795a2d4c6f3203273ef107ed4352736e8b6c2332479082b6c19e727c6c54877c2656d128baae2473127b1ede95a1cea481a608f","ssdeep":"","tlshash":"c2818fd57942b04eb7637311d13121099a9354c74b2a8fcf33cbd9d5504c5a94de13ee","first_seen":"2026-03-26T22:32:14.251355Z","last_seen":"2026-05-28T07:31:02.106149Z","times_seen":4,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/favicon.ico?v=2","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.560Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /favicon.ico?v=2 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:35 GMT\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:14 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"686e416e-1b38c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YpHt%2B%2FHGWipf%2Fw7faHpH3ISbg6fDKvMxT1VxKpCX9l6JfO5dyf8M9GgasZQ0njFjMEF7zFLvevebOjLTW4pdhJtjojZk40jEQjwGi3Vb5pTjyrCZHS12BPbEpvO30Hc%3D\"}]}\r\ncf-ray: 9e299b3f4e4f5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":111500,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel","md5":"a8a7cb8b4087348791048f89711c31b3","sha1":"26ee6a6a9e10f3777c63ac32be13f9f70242a3bc","sha256":"47ab96cdbebdb09ac215a7ddbb22560a386ce6ac77bb0a317dfdef3374e72419","sha512":"a49b2a9b67e021fb47aa70c662d231b3a8f73f22c348be1de9f01079a0cd187b8a43cfb991be92966a7449698cb8438a97de2f811e9557dd2d9f980279109406","ssdeep":"384:VAE0wAuCxxDcoXixkG21zJ0Mgr7X7gsD4inhbAWAJz7aJAYILWINr7UDyhDDDicn:KE0RdxZcOixSeP7gsuuJjmWI/hDDDicn","tlshash":"54b3c47c7c34a0dacbb40030cf6daf9661773f201b96ab9fb3a8be8936215735415916","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.949716Z","times_seen":4,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":180,"receive":80,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-uzcard2.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-uzcard2.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 8858\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-229a\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JfhKVB2CWDZwHnUsmc1c5a0Ne8tBn1H4SScjrPXcYnzwfN5ZISSVuynkx63BMziiGh4WQP7GgqX5BeEsozNZXIj%2BRWyWrQw1LR0fRo8btzxfH1e38J1iubw%2B8tNcTUg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bddb5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8858,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"31b1d36fce2f4172243112a467278fc2","sha1":"b9517dfc37e302f0b6374bd2f6e6abfe19c84b23","sha256":"90d3b3b4e7a2a0ca0781cd5d06a31e6e98043456a3f19bce0bfc2a03126f91c0","sha512":"c886dc6262660953ec3f05e037b678aed245f31d1b096eb4451422f95dd9cc5065f33582eab2de911f1e7332483ca8d3589ed80b73c42c0da2539f8a33371933","ssdeep":"192:wFI5XOR/TyMND54kQu+fBPW+F00Ne1d61aVvKV9rVcKxcv8Aa4jcOhg:wFaOn4kcfB/X461N3rw8wg","tlshash":"cd02ae4880d2f9ed9f23bafd687005432d76809fc6ab80b5fdbd3e044aaa961d116497","first_seen":"2024-03-07T07:34:52Z","last_seen":"2026-05-02T14:40:47.033848Z","times_seen":10,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"royalcash.cc/ws/?hash=913ffd9ceb3ab0ff6039db43c0ec9675","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:35.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /ws/?hash=913ffd9ceb3ab0ff6039db43c0ec9675 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://royalcash.cc\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: DLCJTy93OAzmfNnqPTr+YA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A; wschatid=3447729899de617af2d67451858a285b94490\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocol\r\nDate: Thu, 26 Mar 2026 22:31:35 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: L/C7/ZSyC41ByecQIlY74DhOyq4=\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=O%2Bw%2FZSe2rILDySnhH65XplYx4hvjpo3X%2BMUk6LBWiIwln1sHzPyVfF0%2BBxQeZZdjxhLvl%2FlgwxCHN%2B7W0RwV6amWq5QINO9VaGAiRzkFj8p4OiqUzmCzz7hFdaVO%2F0Y%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9e299b3d5d5256a8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=532\u0026min_rtt=499\u0026rtt_var=156\u0026sent=5\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=3112\u0026recv_bytes=1346\u0026delivery_rate=7192052\u0026cwnd=53\u0026unsent_bytes=0\u0026cid=71b45921824d1c8f\u0026ts=170\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocol","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":0,"dns":20,"connect":20,"send":0,"wait":156,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-usdc.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-usdc.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 8976\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-2310\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2FmWe9nmMuEOsJJMPADSazWinG4Q7g3RnbhIPgz76VMRw93W37rxbrhpCwkE1eBGD9sGeu56wfoTq%2BJ8Ei0U9kJh6TRsyvpVGVR3Wx3abz1isVX6Que69nOCWevE9qo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34fd8f5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"b7b42df6c0c6f8dc70e4809d2305d2d7","sha1":"36522b38c62498dcdde053e450d1f29ce8ebdda9","sha256":"864961c5bdfd12e4b31c9861892bd2356ccb45b90950b9bac7f220500af66e83","sha512":"2feb6667b3feaafc471e2139117c8c87ba1e6c715551cb8d21d1aa88139e93b12f61d534d70bfc96225b884a274a5cf3557da500d6937e20c3f356e76bdac22c","ssdeep":"192:zr7vJc4ChPv0KK/YXVOI1pSLqAikpXdl2UvmszQrHSiQ0fD2Avvp8:/D63XVb10PiOXdl2Uvl8lxvvp8","tlshash":"ea02cf6be5201604e248f5262af8457fc7f50e0815fcffa6e4dd841582f03b45e3899b","first_seen":"2023-05-06T12:21:16Z","last_seen":"2026-05-02T14:40:46.990335Z","times_seen":34,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/flags/mdl.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/flags/mdl.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 386\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-182\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b%2B%2FVvCF3GJZeNRvnqoYipXMI1hY2r2j%2FHF6u%2BKrMOSKPgS1l8ew3jXHra3f12bmmwL86bu%2B9y7WWsNjtducfDW4MtlWwLMd6%2Fl8YceLRqCFCCzrhmcU0gHomvYbAp1g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd85fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":386,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"1b41dba83f4bfd117b15a62c1c53d6dd","sha1":"9f9722c66a1df2d5746bef9e2973ae05daab2646","sha256":"f20543b4d62c8bcc699a62e029660b09d0301bb9fac70bf5b77c6df5bccb8eb0","sha512":"6678dc817c6b47d15d803c74ec033ee7c0297a05b8bfae49d16ecbc52323bb87daeece636eda46112dc69a36d0aadc9449cbe98d123b3dc9991682314572ee24","ssdeep":"","tlshash":"98e06827932190dc636c62d71a4f08afe529ebcd570445dd424ace2981b5f47b1dc268","first_seen":"2023-05-08T12:03:54Z","last_seen":"2026-05-02T14:40:46.881861Z","times_seen":24,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/site_back_dot.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/site_back_dot.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 70965\r\nlast-modified: Wed, 09 Jul 2025 10:16:17 GMT\r\netag: \"686e4171-11535\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fvv7k7pEW%2B9QWZ3ANK8pfhecTriUeiG8aM%2BRXX3JbC2WMLQc1V4rqw9fL1HvULDBV4AYTqYjVLBsrlqzaOHrd7wk87WRd2%2BCmVDdlFUBimSMtDjJF%2FoeyK4m%2BBOd4BE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b38cdf55fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70965,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2000 x 1300, 8-bit/color RGB, non-interlaced","md5":"ad3faae15f914c7a6a84882b770220d9","sha1":"f80d8bc432d31d00872e69675ba10069e7468f94","sha256":"24c6a6d26411cb5b3e8686bfde93334cfa1553bad7c4832e2dcea4ad982be11b","sha512":"f9e12f01be13121e06bb247a45d2aec9eb02d002153a7cc5a1e26c0c8aa71496429fbe9bf7bc09fed99047be84b3480791f400cac67929826582858f430e864d","ssdeep":"1536:6+GB5ALCNqXUrncvA+YzM1vQrl3rQ1/VZmtDwiD4CD1hL+5bC:7GbAMqXMncvEhE1VZlCDDy5G","tlshash":"34639e8d0f274de6eb20d5b3c9612b2373bcd106f622a756e7aa9b6154c3116f113c8b","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.988068Z","times_seen":6,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":89,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/wschat/init/?","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /wschat/init/? HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://royalcash.cc/en/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/json\r\nx-powered-by: PHP/8.4.14\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-frame-options: SAMEORIGIN\r\ncontent-security-policy: default-src 'self' https: data: wss:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' 'unsafe-inline' https:;\r\naccess-control-allow-origin: *\r\nset-cookie: wschatid=3447729899de617af2d67451858a285b94490; expires=Wed, 26 Mar 2036 22:31:34 GMT; Max-Age=315619200; path=/; secure; HttpOnly\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PCcNqcz93ffPQlyEwTHSoFllHbAm5vV2khkLvfkSs5Xo%2FrgTva12H198HVRLEe30O80EqmXpmBmkShQ0y0S%2FrWoNyAYhSKPO4NBrD9H7fkFg0uJQ6hTs0BPLp4Pp%2FLA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b39ce005fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.4.14","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":806,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"2fd5f8756a4203764aa9421936418a17","sha1":"c3cc43fa42944003cc8131a3cba77a43ba01a0db","sha256":"49d5a06b7905b1af38b9b10aeeda5101f8f30a01ca06906fc1eaa9a4962b6cec","sha512":"387c6f8efa32051762359e1883dbc9811779db32786932089f5b142f26263a7e2dd01d1830f88f67e5aaf42c92f6f570f4584a9c6e16111a6b6a8d154c8a9381","ssdeep":"","tlshash":"4301f1447ac2dc7a0b446ee17083b54af0e8266484cadd7bd8c9aa7c855c698418fe1d","first_seen":"2026-03-26T22:32:14.259555Z","last_seen":"2026-03-26T22:32:14.259555Z","times_seen":1,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/session-replay/record/12","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:48.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"OPTIONS /api/session-replay/record/12 HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://royalcash.cc/\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:49 GMT\r\nvary: Origin\r\naccess-control-allow-origin: https://royalcash.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, PATCH\r\naccess-control-allow-headers: Content-Type, Authorization, X-Requested-With\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ByYDm1s4J4KIGFQXtVrngNIakK0hKFQ7LAnKJf0o2Ccy2l0mOKBV1CAYAJEBOTPuNl1wllDmcDzBfXa7P7wjcKUnpuYT6nMKWa2SS9Fpumb6jv006iD%2FDY33WLbCkngYG1tYP6kJM6G2iXYt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b9009805fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-08T11:34:21.534624Z","times_seen":16238222,"resource_available":true,"data":null}},"time_used":906,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":906,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/select2/js/select2.full.min.js","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/select2/js/select2.full.min.js HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: W/\"686661f4-124ff\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=px1EqDCpf3JuEVQTqeLC466eyvaYNgtQdwhvm4a8S1PCFkZtqyv0AMZH5wvpQyNBiOWm87bJl%2BPmVMyJ1hsCx%2B6bT8LYkX2mc7fqOlS%2BmgeY3CxYXhP63PG36KPABfc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b35ede85fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75007,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32091), with CRLF line terminators","md5":"0a3a08dc01bbd8d727372c0a0f2b70d7","sha1":"cfe6c3a94e058178d187751846c3af1092f12336","sha256":"9b8c0a1953e5ea4dfddeb1dbd04bf03da2bf66b0542fba29bb642ecc2b9768d1","sha512":"9aaa00e3db437e21f46a4ca5f0f1091ed68da2a4496b5ed6acfb4be62c7ed2511648b9f33aebb71c6a87cbf477ba40c596c9ae9e281b7eda54e181b22e6c0b12","ssdeep":"768:6o14fnpUZnxyUsdSQmUFkrGBokOl/N8YTP1aFe7MMpQeznipGmZlnU0RyQTAGH0y:HeGnwUsdSNJkOZhfXLEGAzyqAGHZ","tlshash":"5573b848be537235427f20e6656f000a3137ab7eb00955a8b468cde86ebdd14726bf3d","first_seen":"2023-03-07T12:10:01Z","last_seen":"2026-06-07T09:28:12.962974Z","times_seen":370,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/ethereum_classic.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/ethereum_classic.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-847\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vt1%2BxfZA8lh2G5R%2FT8y852TBdD0z549ZnHzfAM7Z64JUnPh9fBIHYMI0VZTyg9E1IM05LYP%2FBzlEmH19ezEayir7SxsmWo3jTAzDZwPpRDNglYwAiVKv4I2azg6yn5s%3D\"}]}\r\ncf-ray: 9e299b351da35fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2119,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e717d118fb24327e3e500f26c069db8c","sha1":"eaef3231f9b02b4b9d23454f1504cb28b3a8c05b","sha256":"52e7f2ec2787e05938a02fdced5629acd81810f0c1a39835e319ef9b67828eef","sha512":"6eb7210d5a2b2f6dd66ce6ac8629a38e2ed69ed2230773bbb4dac5f82e46cd330c6167106b3f29fbceec68ae9b71bdac09ef14fa37c020787b607129e4294029","ssdeep":"","tlshash":"aa415718f0a7441fc225c2f5b6f1ee4ae77960c742565de4f1843827ee264d1913f1ea","first_seen":"2023-05-09T12:00:48Z","last_seen":"2026-05-02T14:40:46.909977Z","times_seen":9,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/royalcash/i/_src/ic-person-24-px.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/royalcash/i/_src/ic-person-24-px.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/res/royalcash/css/main.css?v=26\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 09 Jul 2025 10:16:15 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686e416f-1b1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y6%2FuNPqaAxrmqxWFI8BkxBD4a3la4DGhRII4ypw8Eiu3fephCSTZwzlvr6HVsDaghIR0CN5f%2B3NS2w2dPSc7eMvEN3UWmUyXxmMbOonfUQCdBVNj1xRWuV9GS7y53x8%3D\"}]}\r\ncf-ray: 9e299b38cdf65fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":433,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c7fd5e3a9581e2195e7a7e17460f8eed","sha1":"23fb7bfe55a6c42a73b309c52eaf884a93fe7831","sha256":"972dde9d2dc5f160acb4d9f1c9ae15012f789971aa2aa0a274bf3c66ddcced5b","sha512":"d9b54c3e376905e732423a57b95b95713d9d70e65bae83be31222a6959175f7cd28df54a2e7500c8c1679363632908250f5502c5114524287d4aee342e2016fe","ssdeep":"","tlshash":"6ee02be994e9055c603e8f57a56069989b1df6f3834348b6ff9d15234b219c95043164","first_seen":"2023-05-13T12:06:56Z","last_seen":"2026-05-02T14:40:46.912945Z","times_seen":4,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-neteller.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-neteller.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1066\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-42a\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YVk5hMJjxDT5oIKRqdvGGCw6lwiKYvEFjFBPsvPnCy7cE10Og%2FXjnzCwVn6CVMDNzC8Zbq2uF3c%2FJ%2F%2FSjz9n41fYvHCLdAE3a6wWA3M05BnKnFNLNnpVllNYjB0VJz0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b356db75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1066,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced","md5":"5e355c4703b4406000d08d1d22a91edc","sha1":"3fdf23a2f460303e37f7131bc0e526123f64dd7b","sha256":"49148a2729691a53625aa4267d7e8e3068ad721ce8bd9ed1e97fc563b8104c74","sha512":"7b97112b5550276831ac28add0d23302516ee7290a61690e9a80246e64713d4e868ece62a3e0e0e13878191bc9a5e533a13275e62c81560c6a777de90b23b600","ssdeep":"","tlshash":"ff11e9f1ec064f24f2c25b5310359358baa0bb8d7719640b715c78ba052408d50da70e","first_seen":"2024-08-19T13:13:44.472627Z","last_seen":"2026-05-02T14:40:46.899166Z","times_seen":5,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/svg/wechat_v1.svg","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/svg/wechat_v1.svg HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"686661f4-74f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XQJySH%2FaJ9esW9iJtss2Ugt9SFy%2FnUlnvFaSao3ePvROxhxoKwkMIEwv8akHIkhyJg2OiSaxCpAdbiy9jIGmI0FgXMe8zP54QmrXeNihSQASOYshI%2B1PDY5mFZwUmSM%3D\"}]}\r\ncf-ray: 9e299b357dbb5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1871,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5d5d4890d56aac165b4fd2890977d185","sha1":"861967c0ae7e5a53f86b7be366b452d5d572fc4d","sha256":"22d9219fd6f61c7c82172c887ff1e966cbbee70d12bc5411aea5ea98e37a317f","sha512":"8af12a7e68052f3d913294f193eb1358c8cc13aab32d25103a4937b312a1213368619195fed02641f1bc1d0051a5d7d41009e1780e8f3c74060f0750b6c79c89","ssdeep":"","tlshash":"90310dc2925d9699d0cadb39ff5472b3292d30e7589387e88154cf1a10e1dcbab84d50","first_seen":"2023-10-25T12:20:13Z","last_seen":"2026-05-02T14:40:46.9587Z","times_seen":6,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps88/ps-berekebank.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps88/ps-berekebank.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 6715\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-1a3b\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QJtajevQwCX3C6Sp4NI59qtkL0VY5X5ewJOFgYIeF5doobSYtXCUmzQDIBku%2FD0kQePOvwW%2FKFKOaqXEnxHM%2FsZ6eQN9jGa6%2F0Xgbfc98rtWMb5lGhdjk2Rd0ayGhlY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35cde05fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6715,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"6a34146ee5f796e7f4716810c477acf6","sha1":"a610ba444b00d706743c4dcbe708f68c87a5964b","sha256":"39ef7334af1c454306156b04b9c6c8f3507ef56c1394af99cb581781fc417923","sha512":"843460bb1cca9244f0085e502896059c0a064eb79cddd94711522fe22cbbc701857212886707e9baf66977d385484afb3c1224e820d0b64fd851d9ea0cb94e66","ssdeep":"96:ov9kpXbZRseygZLVVUCIlY9n4C6w5WENgKWdLDBGK+6yNzNQ1A4dUUz5J7oW78Jr:rLZTtLYCTspQgRPBGtReeo85ma","tlshash":"25d19e4684b21cd98953b0b74ae444a5e0589075eb0f02eff536792bb2027edcec2a49","first_seen":"2023-06-16T12:17:05Z","last_seen":"2026-05-02T14:40:47.003887Z","times_seen":25,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/opensans/v44/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://royalcash.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 11108\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 22 Mar 2026 10:06:11 GMT\r\nexpires: Mon, 22 Mar 2027 10:06:11 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:30:57 GMT\r\ncontent-type: font/woff2\r\nage: 390324\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11108,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11108, version 1.0","md5":"57eebb7fb68b973bdae1e19097e3a29a","sha1":"87589576ea69790e6610766d672fc40134ab7729","sha256":"dbb0be746ac930892a1f0303d33f4cca4520120d2699ecadf34efeb6dd52a7f4","sha512":"51fbeb4d41b287357b7f2a02441e526b8edac8b402ab73c3e42c4d07eb873a3b26e3cabf263ee208a78af2a35b35eef23bd9121ab2892430f1612903cd184c69","ssdeep":"192:U+u5RnxCc1BQyNNoRGhMKWGfPG79FO4C19zfj84/Y5zm:UhDnEU5NOcMK3f+77g9zj82YRm","tlshash":"fc32bf14393e5762cfefd5b6ac2533705d8a100aed4cae27d179f694243924b4889f4f","first_seen":"2025-05-30T06:47:47.214507Z","last_seen":"2026-06-07T08:16:34.760605Z","times_seen":1338,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/default/i/flags/en.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:33.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/default/i/flags/en.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 1815\r\nlast-modified: Thu, 03 Jul 2025 10:56:48 GMT\r\netag: \"686661f0-717\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jdzmrU9jj2YwKMx5WWbV0XBCo7KZGp5zyMemWJGeQpoZ9ZOvKg5opcqgEfihj6S2bsA51ECX%2F29kPD0rtlwGI3B48PBtn0HxD5gLz85GhhJhv%2FO3tImfHV8txUKocnc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b34dd7a5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1815,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 550 x 275, 8-bit colormap, non-interlaced","md5":"13f592eadb51d45f06d7368af7cb93bd","sha1":"e9503d7c866773abf8327feea9334a3e44785814","sha256":"451b6204df465c494a246671c7b1aee6dad512ea208c0b8fac0925743927f414","sha512":"abe8f5b7c55f8c0461d4c65bcb9a86e209fe4c434f4bd91643fe87fce6c9ffa0882075b1b1480c68fa6e19ba51fa59770796b21c0ec71dd11663dbfa60e8c045","ssdeep":"","tlshash":"fa31a9de71731be39b56ac51ba10853edef24e8f1030c916519e5068251a88295fa7cd","first_seen":"2023-05-06T12:03:52Z","last_seen":"2026-05-05T20:47:16.742668Z","times_seen":41,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"scriptanalyt.royalcash.cc/api/script.js","fqdn":"scriptanalyt.royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /api/script.js HTTP/1.1\r\nHost: scriptanalyt.royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Origin, accept-encoding\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=14400\r\nlast-modified: Fri, 18 Jul 2025 15:12:24 GMT\r\netag: W/\"434c-1981e17f7c0\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I7uo6bKwDNf%2FnfPOkSD1eqLS9GzqawVldUO%2BNXcdE1uYTqbaYPaCZBrP4tNcv%2FIW2l4bxSMrTE92iVVRS7p19KBA42rdTVEDL68z%2FJkrfRZVScdlUHgJ%2F%2FFeV7zZFopWEpVq3wzw%2FMI9%2BMc9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e299b362deb5fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17228,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (17227)","md5":"c71f2e407f500108a2d7ded7dfb68d3d","sha1":"5c651a89d1d72ec57cc4c15c656a846a4aaee9a6","sha256":"07f6ec6b9b81b2ab5d1e9e0156dc1e24035afd93608b1fdb438c722d0599ea48","sha512":"20f31de92ae9ee064fc4c4c3433a63a09fac563105a24e71856efb6a7ba7b3f42ac4dc6d057ab31f54a812a32169d6e0967c08b920ccb59bc51d41b023bf18a5","ssdeep":"384:eMlXe3Pil/vaSmGwE8utO3KukTQDvFujrwWK3GwofwKwPoCt2vFNjOtpxudS1CQ6:b8/il/vaSmGwE8utO3KukTQDvFujrwWP","tlshash":"107219b63298ac7703dec1a6b07462417b7a5ba19c0e002cf52d7ed35588c8675fabb4","first_seen":"2025-08-23T16:41:30.340733Z","last_seen":"2026-06-07T19:45:25.592576Z","times_seen":256,"resource_available":true,"data":null}},"time_used":1934,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1934,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"scriptanalyt.royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/wschat/dist/client_init.js?v=26","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/wschat/dist/client_init.js?v=26 HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Jul 2025 10:56:54 GMT\r\netag: W/\"686661f6-cc9\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jc%2FMFDOHqUmgw6R3ikh%2B5OSU31By4ZBXA3eHLCKl4RqqAdwn0o5EUVw5pcCdMQdmA16it%2Fbb%2FAGmqdI0t283QMSWMizzunF%2Bf%2BH0uIBTbhXATtwxoDbpNptWbpQQbb8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9e299b35ede95fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3273,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3273), with no line terminators","md5":"d938ef0310aaa401151ba2594955c245","sha1":"dbfcd54386c9ec75a576e88e7ff16e93abc47040","sha256":"9bc01384d7e500b1e1cff7c41b6a5bc6b05c073a1d3ac19431d9c3c654c5d67d","sha512":"c4a993f23c9a56790188e78c2b8a9ed3ad86cd0030e91d62ff3dccca18a7f31e871d2b8bf9025f96a53aee79377589913f5ddee9ad4cdc42cc3b30a5a7bc7a74","ssdeep":"","tlshash":"206110a26e4c26443760baff3917bce2d874dc2934929caad0157c19b54477bd5f3a30","first_seen":"2026-03-26T22:32:14.269061Z","last_seen":"2026-05-02T14:40:47.012336Z","times_seen":3,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalcash.cc/res/exchangebox/uploads/ps/ps-erip.png","fqdn":"royalcash.cc","domain":"royalcash.cc","tld":"cc"},"ip":{"addr":"104.21.67.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalcash.cc/en/","date":"2026-03-26T22:31:34.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalcash.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Mar 2026 16:17:42 GMT","end":"Tue, 16 Jun 2026 17:15:03 GMT"},"fingerprint":{"sha1":"83:9F:64:D9:51:7F:3A:46:F2:52:9C:60:0A:9D:62:76:4F:3C:61:14","sha256":"06:3A:78:4C:17:82:88:1D:D6:C7:2E:EF:AB:D2:14:16:DE:A4:CC:2A:16:93:CB:4E:A7:B4:F1:1F:C3:C7:6C:D7"}}},"request":{"raw":"GET /res/exchangebox/uploads/ps/ps-erip.png HTTP/1.1\r\nHost: royalcash.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://royalcash.cc/en/\r\nCookie: PHPSESSID=ca41f18c278a8ceaa84ddcd7738aaa81; http_refer_id=23179474556584; favorite=169%3A171%3A\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 26 Mar 2026 22:31:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4435\r\nlast-modified: Thu, 03 Jul 2025 10:56:52 GMT\r\netag: \"686661f4-1153\"\r\nexpires: Tue, 22 Sep 2026 22:31:34 GMT\r\ncache-control: max-age=15552000\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eVIdvm8HdbvJL40KoRDRtrK2GqF9fZ%2FRGO66FItElGnT9aPg0Tjn0D9eO1IUe32x3c%2BoJd%2BFWKB4R%2BxbXiNAWSKP9lmA3oU96mhLPAaUvVv7fVJZ3%2BGByX6dM%2Fco2pY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9e299b35bdd75fac-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4435,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"bb401738793a42f6e7dfe125373c228d","sha1":"7bf3c76eaf7d60d3786c1c6446232fe75359fd15","sha256":"fbdb1462a87f12f40a7aadb55d57880026a6116ca7cef6cbddb4149f0de1ad14","sha512":"7bd032b28a81482e4b50d9365f7148daebaca85027a949c2b771ca65d08ecd9440c3695307befc2ca5595300f32a8162c3296d0e30cdaad42e72a8f4c01a83a6","ssdeep":"96:6Vo7Fb12N9g6M6DUQMct27M+g40d7K4JkkDbKIAHD57eqGs2Hb:H7Fx2w6dDUQZA7Dg40vJka+j57eqV27","tlshash":"8c915d0bab516906d095f6db14f1601d6e733c90bce1b07374c2f23ba8b12b4099a9ca","first_seen":"2026-03-26T22:32:14.27012Z","last_seen":"2026-05-02T14:40:47.010978Z","times_seen":3,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"royalcash.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}