{"report_id":"08ca46e2-aeea-4d52-9c2f-85dea6fd5ef7","version":0,"status":"done","tags":[],"date":"2026-07-19T07:18:02Z","url":{"schema":"http","addr":"moonlightthroughvalley.icu","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":0,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"title":"Surniximin | Surniximin : Умная энергия для повседневной жизни","dom":{"size":104287,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9561a0708daa4e3e2c551dfe885e9e10","sha1":"c20305647b07f65d9e767082b9a55ca12deb234a","sha256":"59d3e73d0eeb8c0c5105789102074d757d49601a724914c7227b94c3ebcb0735","sha512":"937e3475cb3890ee399671944e36f2411814f39dfd774ec18cd817b61f2e4541b41e4ba5c315013b90f448ac4d7aca72910cf48811ab6a902b22fe9f15d4b8f2","ssdeep":"768:L3Dv1Xj2LbFfFTFLtF5/tesEGwy94pI7Jiem991OIIjA2:rRXjibhVJtT1nEBw4pINbm9YA2","tlshash":"30a3736659f3105e2403b05adb6a5b063bb8c07bf74eda153e9c626cafc2984c87375c","dom_hash":"domhash5c14acd3139efbf386c3d63c97a977e9","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"moonlightthroughvalley.icu","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":0,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-23T07:18:02Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"moonlightthroughvalley.icu","ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":46,"request_count":23,"received_data":2296047,"sent_data":18393,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":2,"received_data":11369,"sent_data":1116,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-12T22:19:35.511658Z","alert_count":0,"request_count":5,"received_data":154668,"sent_data":2987,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/cookie.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c03f86ad40cb25076dbdafe7aab651a3","sha1":"83e8eff45857beab9de19994bf3584e863912f7d","sha256":"56146679cdfd083fb0bc0a020f036f73b8fa5905828ffc33307ec47fb212af10","sha512":"4aa29fbc5e916c1d42d35be85f40d2aef64a939465817b056be5dfa69a7d4b64e1aa3780d4a1b41632035ec955820ee08b1bf09515178d9d53dd0573f0448cb8","ssdeep":"","tlshash":"03e0266b3efe0eb403eaa6fa1018234d31324014b049460e6a3828aa2cd5f0a0c328df","size":336,"data":"","first_seen":"2026-07-19T07:18:10.06118Z","last_seen":"2026-07-19T07:20:06.924518Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c05fa95e8b868afda407944fbf26b308","sha1":"607b66f65f21d76b6abdff06ca611b6399eec39d","sha256":"a2033cd161f46c4fcb49d6a9ba08ea2463e093eccf98eb4dc24eb5ffd54b1c8a","sha512":"734795a4e2caef33cc9a2de3e8857c928bbdebeb153c49f832cf6db0b29e3410e48cdd633c9432b9a74fb89146f2d5e4233b35a10195f77b26df2ba5dd4e5e27","ssdeep":"48:1YhHK7r/tqh48h/NQTSSIWK4cvoGCDIIGyrg1/V4lO+uvmCeFdiP:WHKv/Uh48hqdKXC0yroNsiP","tlshash":"c5915b2811f53c39007369eea7cb85c93125908bb14ac96a3a6cc70b1f929d18de26df","size":4395,"data":"","first_seen":"2026-07-19T07:18:10.09865Z","last_seen":"2026-07-19T07:20:06.945813Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/bootstrap.min.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4800bcc26467d999f49b472f02906b8d","sha1":"2c6c0a58345a09d3761230af823a4e4852b12643","sha256":"de040986d9a3ed89d5d5f9ad6d5727015e9e238c2cd13af8f1b55909386d0864","sha512":"ca4675410af4272ff8664bcabaa5a7e2217796a3d9ca28fd891bfab06a8b45d4cf918ebd617ebeef0bd51a6b1d05b8887cdffc39db08ec70018ef12893a668a5","ssdeep":"768:WkN++EvGHWyOOY/uwAxOlU5iBNY5XPxyvTPBVRKwi/C9rfz7uxk6yH8Xae53XC7e:W0xY+t/Nhho1d76KV2O9Ed","tlshash":"3043b6563244b9330ade84e68172430bf7195d98b547816cb5bcacde2b7dc827273bb8","size":60635,"data":"","first_seen":"2024-04-09T12:24:13Z","last_seen":"2026-07-22T01:49:57.141945Z","times_seen":4064,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/jquery.min.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9771cc3e90e18f5336eedbd0fffb2cf","sha1":"6ee8aaa3ac1f4e0ae18717a3fd26892e9f0e4cc5","sha256":"3e7501d15c3630e791c8b20392eb9dee31a9f65ce3efdde76cef5c710141ab24","sha512":"c503341fa3a7176fd10bd8cd7a5717c8faf971f87fa0c158f2d94fcd484ae3ed5031f49414dae833fb806b7365b5699c21d2e655376f69adb052b22f6f6982a7","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GK7:sHNwcv9VBQpLl88SMBQ47GK7","tlshash":"8083f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87532,"data":"","first_seen":"2023-10-13T22:05:06Z","last_seen":"2026-07-22T04:05:00.407115Z","times_seen":30119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/style/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.729Z","timestamp":1784445454729,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/style/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6 HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/style/bootstrap-icons.css\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 85044\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-14c34\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85044,"size_decoded":85383,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 85044, version 1.0","md5":"316400c09c0560b3812e58b3124bbf15","sha1":"2314d4d73dd9ed7aa2f9d18d45e71ca0440ac0a9","sha256":"856b3f9e0df4f7061c8948021c7cc6e6263d96c48161e7fe9e4fbefd0c69a085","sha512":"d410d293cbd3fc7198c171d72c137d3032d0d1d8c8108aaa20dd273e745ea3df928242cfa2fe5a095af36e43ef3883fadb3794295dba6403f61d575e659ffb81","ssdeep":"1536:zy8frvR5PzrH/MIF87QvPUJz7e9JWb81gImxOj+HX7jzjdO8MxZucXgApaZnCGOx:7frJ5P/H/MIzkzyJ3gImM4HJ90ucXg2t","tlshash":"12831285e754eebcb500e861f57770987a474e10eb9bf9101d18e0e9c8e1f698a8fb60","first_seen":"2023-05-03T14:41:05Z","last_seen":"2026-07-21T14:52:23.401327Z","times_seen":1187,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/style/bootstrap-icons.css","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.285Z","timestamp":1784445454285,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/style/bootstrap-icons.css HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"684bddaa-17fcf\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98255,"size_decoded":14469,"mime_type":"text/css","magic":"ASCII text","md5":"1d14ac4000dc4a8d3557b256248d9000","sha1":"9ee496cc9baaae58b98e7fc1eb46e3578daf8143","sha256":"4ffa6bea4304d2eda418683f56261685ed47bf00995039f27e5ad62d53938d2d","sha512":"cb098f6eec464b8709ec6c70097f9b089c1e79ec6dd38ed9614d873f9d9658a6e9267178fd9cdfaf6068d7d2780963d766695e56eb10f5dfff441e5bab444fef","ssdeep":"768:Tqnm8OAL1Mzocm4KyH2CJwZwmij34k4RDlWIbWPVUMR:KOocm4FJwZ5ijINRDlIia","tlshash":"d5a3eeba914f05f9d341e4d92743674693aaba3cd1813c7ad342399ee3c1a188ad73dc","first_seen":"2024-01-08T15:48:29Z","last_seen":"2026-07-22T02:46:00.945493Z","times_seen":4297,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":18,"send":0,"wait":38,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/bootstrap.min.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.287Z","timestamp":1784445454287,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/js/bootstrap.min.js HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"684bddaa-ecdb\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60635,"size_decoded":16930,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60356)","md5":"4800bcc26467d999f49b472f02906b8d","sha1":"2c6c0a58345a09d3761230af823a4e4852b12643","sha256":"de040986d9a3ed89d5d5f9ad6d5727015e9e238c2cd13af8f1b55909386d0864","sha512":"ca4675410af4272ff8664bcabaa5a7e2217796a3d9ca28fd891bfab06a8b45d4cf918ebd617ebeef0bd51a6b1d05b8887cdffc39db08ec70018ef12893a668a5","ssdeep":"768:WkN++EvGHWyOOY/uwAxOlU5iBNY5XPxyvTPBVRKwi/C9rfz7uxk6yH8Xae53XC7e:W0xY+t/Nhho1d76KV2O9Ed","tlshash":"3043b6563244b9330ade84e68172430bf7195d98b547816cb5bcacde2b7dc827273bb8","first_seen":"2024-04-09T12:24:13Z","last_seen":"2026-07-22T01:49:57.141945Z","times_seen":4064,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":18,"send":0,"wait":37,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/style/cookie.css","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.290Z","timestamp":1784445454290,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/style/cookie.css HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: text/css\r\nContent-Length: 662\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-296\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":662,"size_decoded":995,"mime_type":"text/css","magic":"ASCII text","md5":"b68a0e4e738a7bd942fe31f39d54c583","sha1":"fe83c78db6e97b0dfc6d02dfc90405601c98d0c0","sha256":"ee849532b57f44c5275af94074ad4e9f6534542b813ebe5f924e0e09779b4ce5","sha512":"bb0cf246a6c99aeea13ad4f2fd0dd428fa35355abc9c6b07ec29b992a481bbe5cb19aea21e45fda9fae818e6103ddd913b3d0b87bbcf111c57a5af795aafaa34","ssdeep":"","tlshash":"5a019ec1aa96120c7587d05c2864460523aa8492e18fde7c2ae5206cefcd3815c731da","first_seen":"2026-07-19T07:18:10.049649Z","last_seen":"2026-07-19T07:20:06.921567Z","times_seen":2,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":18,"send":0,"wait":20,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/service-images/universal-solar-energy-at-home-340ee-1.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.301Z","timestamp":1784445454301,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/service-images/universal-solar-energy-at-home-340ee-1.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 71701\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-11815\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71701,"size_decoded":72040,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 79\", baseline, precision 8, 750x507, components 3","md5":"3ca485e1b33e3da5eddbd62b68f6352f","sha1":"673440dc4089768a9fa858c1bb91a2d6e59b4652","sha256":"eda0384692c9f19e40aa7db137e5b5449541cb46e0fa493b263ddde1332b446f","sha512":"98a0dcaba9a2d429bef22cc1d39408e9a7fd3db17a8e7a46425790d63c8a0895f4ad70e14318a6b0768a822c09fed8c24c3d4bc4eaefe3bbd076135f30e3789a","ssdeep":"1536:5eo04utlCoP/s0jjnuBkIZprA6kNks7h8EVgGN+F7w/y6dgpXv2TqPUlkKJp4+IY:U2sT/xjnuLf86czh829uf6dSOOK43Y","tlshash":"386302f0a657b8320b46d1f2909fe0d374bb28350ede74dd7e13a1c8651ea0194358fa","first_seen":"2026-07-19T07:18:10.052583Z","last_seen":"2026-07-19T07:20:06.922424Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":255,"dns":0,"connect":0,"send":0,"wait":19,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/profile-3YC-1.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.304Z","timestamp":1784445454304,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/profile-3YC-1.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 86167\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-15097\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86167,"size_decoded":86506,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x800, components 3","md5":"6108e27cf0ee61dc41d8153fe17f47f5","sha1":"121ea9ef30b395e31f1b8b6ab9bdece15ad7fcc9","sha256":"12f571e543e2379e30ed8f96432e4fe68233efcac025211aa0bae2f26773797c","sha512":"4ad306ad1721f6b1e4ed3016b27da0b2db51fa4af2aca684be24233fa3781df24a40da80441a6297e44f85b3f48a9ec13e62e6fd3608d20fe32d29738df310aa","ssdeep":"1536:5T1VR7/+xEFQb7iXClCvNYchc5t7kaOQvMuq4ug8vkjQMAO/RgbRdl:1RqHiylSFqBZvMuqFHsVD/Rg3","tlshash":"90830220fb42d7d5db4b03a566ac2eba43a451c0819505bf5e7f1fc8781bfa20b83725","first_seen":"2026-07-19T07:18:10.055092Z","last_seen":"2026-07-19T07:20:06.930376Z","times_seen":2,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":272,"dns":0,"connect":0,"send":0,"wait":20,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/pattern-bg-IT3.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.669Z","timestamp":1784445454669,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/pattern-bg-IT3.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 267429\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-414a5\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":267429,"size_decoded":267769,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3","md5":"41609f471279b6c5a30a91417e6b713a","sha1":"285a632aae81c96d80a332f3fbf0e28f429dabb2","sha256":"75841740518580f936dc679234a0d48c8bba446775be9685b0c4e933e37781c9","sha512":"0836318088d02144f6daa7a50225417eadfecd25b74b5d1ae8e6535ac5e9bb4599e6630e6fadbd731723490435116ce6b640f03cb4bf83079d3ad6bfb256018f","ssdeep":"6144:QGzn5ogjvx3J1qStc5rczJUEjA8LjFyb1AlM/Ktp/kbcdnsLTPySoERJ:Q65TjvxNtaajsJStp/h+L+8RJ","tlshash":"9f441206a5d0637c77eeb9f02bc0f32782bd6d7876e42258271c9d91816286377398f5","first_seen":"2026-07-19T07:18:10.058379Z","last_seen":"2026-07-19T07:20:06.93671Z","times_seen":2,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Sofia+Sans+Semi+Condensed:ital,wght@0,1..1000;1,1..1000\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.279Z","timestamp":1784445454279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Sofia+Sans+Semi+Condensed:ital,wght@0,1..1000;1,1..1000\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 19 Jul 2026 07:17:34 GMT\r\ndate: Sun, 19 Jul 2026 07:17:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4106,"size_decoded":1292,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3cf0bc90843d2c9bf69ecbd02fe36516","sha1":"b213a10f1722f37c1725c408c10aa4afac4604fa","sha256":"2f6e212a2f62494a6dfb14dabe29302d3b5614f08d2fee437ac45aac5b7ed13c","sha512":"cfd7d8194c13bece5228a4188ebbb9d6d7c7be22539ca8a343f647ed87643bf3aca2cd1535c8b0c0bb66a00e1de45b0a3385c91b7df7c77de076564a0fc782f3","ssdeep":"96:VCYgIalFCYgIanFZiCYgIajbCYgIa2Jc+uMCYgIaaNcCOIaKFCOIajFZiCOIafbL:BIlRIcIjrIWvINKHmf1r53","tlshash":"37812191044e5718fb435cc63bcf6e259d4f9632609dc8b85bfc0c89acb5e1b02a9b8d","first_seen":"2026-03-12T00:28:28.758533Z","last_seen":"2026-07-19T07:20:06.937389Z","times_seen":3,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":2,"connect":17,"send":0,"wait":33,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/cookie.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.291Z","timestamp":1784445454291,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/js/cookie.js HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 336\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-150\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":336,"size_decoded":683,"mime_type":"application/javascript","magic":"ASCII text","md5":"c03f86ad40cb25076dbdafe7aab651a3","sha1":"83e8eff45857beab9de19994bf3584e863912f7d","sha256":"56146679cdfd083fb0bc0a020f036f73b8fa5905828ffc33307ec47fb212af10","sha512":"4aa29fbc5e916c1d42d35be85f40d2aef64a939465817b056be5dfa69a7d4b64e1aa3780d4a1b41632035ec955820ee08b1bf09515178d9d53dd0573f0448cb8","ssdeep":"","tlshash":"03e0266b3efe0eb403eaa6fa1018234d31324014b049460e6a3828aa2cd5f0a0c328df","first_seen":"2026-07-19T07:18:10.06118Z","last_seen":"2026-07-19T07:20:06.924518Z","times_seen":2,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":17,"send":0,"wait":18,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/pattern-bg-IT0.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.665Z","timestamp":1784445454665,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/pattern-bg-IT0.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 168429\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-291ed\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":168429,"size_decoded":168769,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3","md5":"9d78758150012adbff2975367906b781","sha1":"f6d187073c840351544c4fe54345582eb812186d","sha256":"721aa123586e63f2aa2d4c28f33f1df05181b43debfa0762f0065b815820d300","sha512":"e9a02933ccfdfa8ecde0f3fb94be94f95371be5827d71aff3cf152d1c7e364a983eb73a1728b7dcc0d35d88065f57007e5545c8b9c50c9a906f7ef009cac9b9e","ssdeep":"3072:0xcl4zO2E7upXOxuSnKpZYtlyrf7jMS4PxyuJWrmuYw8ImzknT+ebx6iADm:ll4zO21pXpSnEZYt6f7jMDPx/FIiafbv","tlshash":"bff3129521025d6ad92977f3b0e923b65886cbc7aa0647238d448dbef82647c3f193b1","first_seen":"2026-07-19T07:18:10.063817Z","last_seen":"2026-07-19T07:20:06.936077Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/light-overlay-1366x7680.png","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.672Z","timestamp":1784445454672,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/light-overlay-1366x7680.png HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/png\r\nContent-Length: 151268\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-24ee4\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":151268,"size_decoded":151607,"mime_type":"image/png","magic":"PNG image data, 1920 x 1281, 1-bit colormap, non-interlaced","md5":"109f8af8155aa3f754bb9216555e7d08","sha1":"54028c2d5ae1ef476c0cf838a32d1729b7763415","sha256":"df500c2c51640c08a4655989dfcbae9850a436eecf1dac30f0c6e0fb34866c02","sha512":"45f8ef97f2be4fac470143a6631082b1df9370b87f20d61b6ee0ae4f637a55149df4d8e3c4950af284d1aeae4f6dc6a2cd30b172ef3600e862bc021d1549882b","ssdeep":"3072:YU/X2ir2GtLY9/SNNJ6tqKUCGb2yWEo7NWT+R7t75qQIdPHICfxsECb8escU:vGirft89/oN0tqKMWEo7Nq+Bt75jIBl9","tlshash":"98e313d1f4ea8b701703e09aa63bfc60bc5ec31c552e5aa0f53e50a479393bb7559384","first_seen":"2023-12-04T03:10:18Z","last_seen":"2026-07-19T07:20:06.927727Z","times_seen":5,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sofiasanssemicondensed/v8/46k7laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWYE8EaT.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.733Z","timestamp":1784445454733,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/sofiasanssemicondensed/v8/46k7laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWYE8EaT.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://moonlightthroughvalley.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 42324\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 13 Jul 2026 07:22:28 GMT\r\nexpires: Tue, 13 Jul 2027 07:22:28 GMT\r\ncache-control: public, max-age=31536000\r\nage: 518106\r\nlast-modified: Tue, 09 Sep 2025 18:51:40 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":42324,"size_decoded":43137,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42324, version 1.0","md5":"30250d065976b1049cb671b9614eeba6","sha1":"e038a5e0728a31437eb64e7384b0e1717ef69456","sha256":"15d337ccc0e2d289d8792f15052ee8a3a08cbb3aa6df9ea9a2de9ae6507b89ff","sha512":"8d749ad1a2201879bd4008c8587ae24241afa2645f7880e0446ba561598c53023fc7cc1d0ea43bba1cad335861cf77daf4baacb1e97b1ec82bed647fc2349b28","ssdeep":"768:ZQeGXGh5Bh8j5IYz3Xodw/8ePnS5m4YDk8/KjUNzanCoExKAayIx:2evH8j5fzsMHIY4QeVE+h","tlshash":"9013f28e59791935c3b3bb280ceea3ccbacf1111bbed0d65064e9792f45147d54ae930","first_seen":"2026-04-07T03:00:05.198195Z","last_seen":"2026-07-19T07:20:06.925226Z","times_seen":5,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":22,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sofiasanssemicondensed/v8/46k7laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWYE9EaTncQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.737Z","timestamp":1784445454737,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/sofiasanssemicondensed/v8/46k7laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWYE9EaTncQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://moonlightthroughvalley.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-type: font/woff2\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 25688\r\ndate: Sun, 19 Jul 2026 07:17:34 GMT\r\nexpires: Mon, 19 Jul 2027 07:17:34 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:55:18 GMT\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":25688,"size_decoded":26488,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25688, version 1.0","md5":"2baf81cae61efb2da910cac545068410","sha1":"ddd29871b133d335ec58c4117b31408911a76112","sha256":"716fff03809674f9a0bbd03adf4886d05408e23e1a7e874c471259a20a9ae72e","sha512":"c1f982f647178111b3ead292e94fc56fea934d8a0a34b13ee7a81a5e41b2d99e7b1a788f633527a0eecb435054e848494712406bbf55e853cba3eb294e4f6559","ssdeep":"768:LiG6SH7Qu8sJsfyEmqEFG/NDkeJh49pMr:LESbQRsum5GlwmmS","tlshash":"cbb2f1da3da46ea1dee95f30a250d7d240c375c6f40a99a17f3d102ba4fc1ba0e5b146","first_seen":"2026-07-15T12:38:03.251435Z","last_seen":"2026-07-19T07:20:06.944582Z","times_seen":3,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":101,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/profile-3YC-0.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.302Z","timestamp":1784445454302,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/profile-3YC-0.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 52184\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-cbd8\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52184,"size_decoded":52522,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x800, components 3","md5":"0774462ce06183510e4f9b9d7222bf71","sha1":"8d5a80fe10c00cb6c7759f41c20e1f800ac29ded","sha256":"66a3b5ff0b0c790a0d003d02485485222e065f3e5b3ffd406d35287d592543fd","sha512":"844cf586026ad373781ce4ea7b74938f2e0388e56fe1153d0ea0039d969bf97c19387c74887e4906c5078884e90c2e869cdb64840e26831eccb9958fdc260655","ssdeep":"1536:5of/yQUck5pEow3pOdxHNtFhZHLHuj29ddfSD:+fzI5p+3pe7FhZaiyD","tlshash":"8233ae79fbc393410f675baea43c3e331b6920c824cc6d1756a38c559184f7a976b22e","first_seen":"2026-07-19T07:18:10.0717Z","last_seen":"2026-07-19T07:20:06.929714Z","times_seen":2,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":292,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sofiasanssemicondensed/v8/46k9laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWc08l6X.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.732Z","timestamp":1784445454732,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/sofiasanssemicondensed/v8/46k9laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWc08l6X.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://moonlightthroughvalley.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 25808\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 14 Jul 2026 10:40:35 GMT\r\nexpires: Wed, 14 Jul 2027 10:40:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 419819\r\nlast-modified: Tue, 09 Sep 2025 18:55:32 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":25808,"size_decoded":26621,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25808, version 1.0","md5":"a524574f99d5a8a72576806c658f3e1d","sha1":"e766bfca591f8a16e190297242bcd75f9457e686","sha256":"591a45f39f8b53e0bc84279d5c5a13f1ec01305f284922a1ba7a6439906010c3","sha512":"ca5ac4d057fa7006901ad47194a9a3da7005e0594d2476a68af27097230eda4da119ea26584b03070cbe4a456f64df84338363c8d023a6728d6d7430455525df","ssdeep":"768:gXHckoJEdIZVqFKnpJcyvBG8ykwGSVI/FBnc:gXHD3tC5GoRtFBc","tlshash":"b7c2e0e84981a7cbac543022f52c49558a4ef829ad43c0fc7f94ccf5a2497db8a716cd","first_seen":"2025-10-08T00:36:29.786226Z","last_seen":"2026-07-19T07:20:06.931156Z","times_seen":5,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":28,"dns":0,"connect":0,"send":0,"wait":30,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/teko/v23/LYjNdG7kmE0gfaN9pQlEpVsHVQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.735Z","timestamp":1784445454735,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/teko/v23/LYjNdG7kmE0gfaN9pQlEpVsHVQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://moonlightthroughvalley.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 15264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 13 Jul 2026 19:48:50 GMT\r\nexpires: Tue, 13 Jul 2027 19:48:50 GMT\r\ncache-control: public, max-age=31536000\r\nage: 473324\r\nlast-modified: Mon, 15 Sep 2025 17:03:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":15264,"size_decoded":16077,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15264, version 1.0","md5":"21c1966f1535b75b772cd782f4bdce05","sha1":"df8c2865d1240e3eb3183d3f8fc97a047ec1a92c","sha256":"13626adc698ca3982595b130053d69e117d004c66a1449227597a86b6ac6e446","sha512":"9c94410c1c76b8fed70f9645a696f34a1298c14a62de11b34331b82a7b519096f4cf20229439c6aed35b697e7d0f4ee6fb9e78ba2bb7cea8761c1a3bdc0168a6","ssdeep":"384:uUXHu3IYTpYgOMJLD2/me3KLlixWBUL101DUgmBfbg:3MphOs2ue3KpKJeDGBfbg","tlshash":"9a62c1258e352dc6d74ec72b81b91c61c34455b3ca2ede2eda54b7085b3f0432a3681e","first_seen":"2025-04-24T04:57:47.892353Z","last_seen":"2026-07-20T22:48:56.532759Z","times_seen":2121,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":36,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-19T07:17:33.651Z","timestamp":1784445453651,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:33 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, must-revalidate\r\nContent-Encoding: gzip\r\nExpires: Sun, 19 Jul 2026 07:17:33 GMT\r\nSet-Cookie: _subid=18uumd01eleq2; expires=Wed, 19 Aug 2026 07:17:33 GMT; path=/\n7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64; expires=Mon, 20 Jul 2026 07:17:33 GMT; path=/\r\nVary: Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":104672,"size_decoded":19257,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ec4bfab4ec5568da5912bf30b62cffe9","sha1":"75a1c683b05fa524b233ee1c1a4359475af2241a","sha256":"f53f8e1cb45c001a51d829fb20e87e8a326e3eab8a60629b570d4445e49a661a","sha512":"5a4893c7f38dcf87a19979d714abe8b245b8e923e9df8dab6c55672f1a2495bda6f40bd6e73f18177edecb858e21eaf0a661996fe2734fef8f5156a188422a19","ssdeep":"768:CUWv1Xj2LbFfFTFLtF5ctebpywy94pI7JieUd98OIIjAa:J8XjibhVJtTQCpNw4pINbUd1Aa","tlshash":"f3a373664af3105e2403b05adb6a5b063bb8c07bf74eda153e9c625cafc6984c87375c","first_seen":"2026-07-19T07:18:10.07709Z","last_seen":"2026-07-19T07:20:06.928421Z","times_seen":2,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":61,"connect":18,"send":0,"wait":39,"receive":18,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/style/bootstrap.css","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.284Z","timestamp":1784445454284,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/style/bootstrap.css HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"684bddaa-449d6\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":281046,"size_decoded":33824,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (343)","md5":"1162850e40492183d0df775907004258","sha1":"666432047b69deb71fd0481e37c11f0e56b5016c","sha256":"18a105d7cb38e01e5ed0ca255c092992a2e211b39594a7fa57262bfc6fc4ea9c","sha512":"55cc94824a1b73286a425ef81d2d537133272c47dd7d7e816e3847f19063154f584f01f0b6846d5921b38690d5109aad325bcb336cf72488b150ebbadcf34261","ssdeep":"1536:6OK0SRNPWWMUsyCK3i50nC9Df541C15tNBg11l9a885wVDAudtIjNbPZO:6lWWdAudtIjNbPZO","tlshash":"80545258fdf12478387b9259659bfef8bb7c5086ca09cc75b9c32224cf853d158a29c8","first_seen":"2024-06-24T23:12:55Z","last_seen":"2026-07-22T03:19:45.004653Z","times_seen":1017,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/folder-data/js/jquery.min.js","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.288Z","timestamp":1784445454288,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/folder-data/js/jquery.min.js HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"684bddaa-155ec\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87532,"size_decoded":30769,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"c9771cc3e90e18f5336eedbd0fffb2cf","sha1":"6ee8aaa3ac1f4e0ae18717a3fd26892e9f0e4cc5","sha256":"3e7501d15c3630e791c8b20392eb9dee31a9f65ce3efdde76cef5c710141ab24","sha512":"c503341fa3a7176fd10bd8cd7a5717c8faf971f87fa0c158f2d94fcd484ae3ed5031f49414dae833fb806b7365b5699c21d2e655376f69adb052b22f6f6982a7","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GK7:sHNwcv9VBQpLl88SMBQ47GK7","tlshash":"8083f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-10-13T22:05:06Z","last_seen":"2026-07-22T04:05:00.407115Z","times_seen":30119,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":18,"send":0,"wait":38,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/album-Ao0.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.307Z","timestamp":1784445454307,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/album-Ao0.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 64071\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-fa47\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64071,"size_decoded":64409,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 650x433, components 3","md5":"1324b17b04a1779058b4a113764aa4f6","sha1":"94eaa2fd3d98f0c9f0db044c6ea5924b2bef7c32","sha256":"e3b42c364bd7d0242423667ee2122633f62361650723bdab315af73a01b06a8d","sha512":"9d9fa9ae47e311a836f300b7e5a0f031351097e4590032d2b48eae2fe30d851a3a992e927e43fb9d2cb096c06e1cf6a5794cf6620e8c87060c9338f0b749e003","ssdeep":"1536:/8CKBuwGkTxlChmqBO4VD9AuwYTDXtgDaqmstOOs+le2DRA:3KBuwGU6h9Vxpw8Xt54sCFA","tlshash":"c953125259d4da75db6b49d3df80cb888c2e96a9df9e679d7990c740f1daa033020c3c","first_seen":"2026-07-19T07:18:10.08027Z","last_seen":"2026-07-19T07:20:06.926946Z","times_seen":2,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":253,"dns":0,"connect":0,"send":0,"wait":19,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/thumb-q80-1.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.309Z","timestamp":1784445454309,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/thumb-q80-1.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 85805\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-14f2d\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85805,"size_decoded":86144,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x800, components 3","md5":"aefe709fca6da190a20e39cb10feba31","sha1":"ca43213bc8f011cdafdc8f506b698d33e89a2cbc","sha256":"da5caf7e842ce21c929d6c181ead6a483a43facd51e8ae78d6486087c41140db","sha512":"c5288c753d8a56f52c6233b5828d1d9f96eed29c4b222263dd2cada990c1876c20995ae1b5db8357c884c6078ca21f305dc5138e5f4514f6b629c11c53a7f74e","ssdeep":"1536:pqmAoI4wMavT33eYwCN7K8eeAHlmXvxKG/av/t47OthTQyRwmElJEhys:wmAP4epgp3FMved4athNHEDEh5","tlshash":"ef83125946492def6dcca7b8dc988fce1311a73c9dcd330229d6e228adb41789b447c2","first_seen":"2026-07-19T07:18:10.082403Z","last_seen":"2026-07-19T07:20:06.938086Z","times_seen":2,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":253,"dns":0,"connect":0,"send":0,"wait":36,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/pattern-bg-IT2.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.668Z","timestamp":1784445454668,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/pattern-bg-IT2.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 244141\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-3b9ad\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":244141,"size_decoded":244481,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1079, components 3","md5":"ee98381600cf8b51bb9b0ad996c45f26","sha1":"bf9b6cacff63176f62ae08adc0d444d0eb840afb","sha256":"148fa91e3ee55d3b26293878fe94248b48d0ffab19c4bd1cee790c7a8fb37807","sha512":"2a6fb161bf3fbeeaab4e0bd076229e0431e57dca55228582dd20829ca1ccaaf1490a76b314d5c5f714133f745175779e39fe1ef12349402404f085bfbd175849","ssdeep":"6144:VgieoUWVdk5tIO7CAqjfzseWdaTGbiP+nNSks2I5Ep:Vgie7wAtf79c71OaSbo+NSL2bp","tlshash":"b63423b87f76c1bb23288562310cc1a7568401866df1fd8cdbbb6fb1ddce209ca2054a","first_seen":"2026-07-19T07:18:10.084512Z","last_seen":"2026-07-19T07:20:06.942483Z","times_seen":2,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/logo-white.svg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.299Z","timestamp":1784445454299,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/logo-white.svg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 3603\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-e13\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3603,"size_decoded":3942,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a97adf86152101b34390b38cf4d0b914","sha1":"46d0f78921666915f83f379c3c2e9417b28af49a","sha256":"7f92a93e49ff6e3810b8097621f36f53f8520aeed880005f1c28a79451c003a6","sha512":"6ac5233c9d95bf03894a6a0d0c24ee7145849c4c35eb63db91e9afa5c950028f2cb0e348d4b18cc97e6d574abd852fa12d6bdbccdc0c31534b3ced4618db28be","ssdeep":"","tlshash":"8571747a0318aaf7058787c5cbfa709722a161e6b29ae0dcebd326275c01df70174975","first_seen":"2026-07-19T07:18:10.086241Z","last_seen":"2026-07-19T07:20:06.934011Z","times_seen":2,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":255,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/thumb-q80-0.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.308Z","timestamp":1784445454308,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/thumb-q80-0.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 103426\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-19402\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":103426,"size_decoded":103766,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x800, components 3","md5":"cc5960ea0f3d3ff736e51a1f2df3657b","sha1":"898675bc617cbfa54512fd4199596dc4e7471519","sha256":"0a472a33478edc4788462a53e41e5e9e866887b92f70738aafe33d3505a4e569","sha512":"24801336355de74e27ef0cef6651f40d60813bc8419c92a6d98777bce905b672e10ca216baeac2142a8638b289adb5186d2b5e44f2bbb95a0db34f18f405f9b3","ssdeep":"3072:QpurySJnpXtT09O3yKMJ3OL6EsVH1aSjUZyg:jrygpW9OCLp1LjU1","tlshash":"00a302078984fde19b24a012f6bf42dbadf209dca94a54321d107bc5dbbf91459a3cbc","first_seen":"2026-07-19T07:18:10.087337Z","last_seen":"2026-07-19T07:20:06.93542Z","times_seen":2,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":291,"dns":0,"connect":0,"send":0,"wait":18,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/profile-3YC-3.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.311Z","timestamp":1784445454311,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/profile-3YC-3.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 99982\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-1868e\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":99982,"size_decoded":100321,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x800, components 3","md5":"e60454ffca2a36e840822f176737b128","sha1":"c3db5d622f89ab1075f9474bbfd26013a7df516a","sha256":"80004a12947cfd08e2d581340e98d578162fdfde7ee082700a51b266b96848e8","sha512":"4f1f8b2dbe50e73b554cb522ce5b5c73e683e4359f2e8336a488bb49cd125b769b358a8ff4265a4fb9ef7321dfffad9288b097528332b4a9732f2720889c94ed","ssdeep":"1536:pJ5TrLRGjIhe8+l4X8S8t8ZBI4VAuBxkr5ZXhypr+bzHMLv9UuVMOyQawC:35TXRGjUfwuwyBvcZX+r2sj9dTyQhC","tlshash":"c6a31279e020f1564fe2249e1c38fd7f9fcd05a927c19a2878392299e407a75df4b709","first_seen":"2026-07-19T07:18:10.089365Z","last_seen":"2026-07-19T07:20:06.939834Z","times_seen":2,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":252,"dns":0,"connect":0,"send":0,"wait":18,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/profile-3YC-2.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.305Z","timestamp":1784445454305,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/profile-3YC-2.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 57374\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-e01e\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57374,"size_decoded":57712,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x800, components 3","md5":"a830e5c705d385b3f7db3b49c2fef944","sha1":"2028def030825bf93c1d820bdbc5abb6de04922a","sha256":"804dad80a3cafb25d69168bf194ce3ffc9b53162daa48a176ac353053f5957a9","sha512":"4a135447d7e8ccc6a73b9ebc50ad1a63fd6294a18904f2c8452244927a0f9496ae987464f6552000f458d7cfff287c062172f297ae5477ad51b16a00c95aed70","ssdeep":"1536:pgjCwY+kAjK5aOP3DOPTEhdX93+0OfMfdArc:UCx+bbOP3MT2x93vOfM2rc","tlshash":"9f4302969fd17465441fa3827c4c4babb3e0bb974b3db6ab052ba451d888160c30ff5b","first_seen":"2026-07-19T07:18:10.091912Z","last_seen":"2026-07-19T07:20:06.934743Z","times_seen":2,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":254,"dns":0,"connect":0,"send":0,"wait":36,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/files/images/thumb-q80-2.jpg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.312Z","timestamp":1784445454312,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/files/images/thumb-q80-2.jpg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 110480\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-1af90\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110480,"size_decoded":110820,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 800x800, components 3","md5":"2c362bf276e688f807b1adf384064bff","sha1":"964afe7ed2476661192a599ac15bc12ab7ddc047","sha256":"57c6f56c85eec9d573c7c5c9cbb518f095424937aeac911aed851fba7ccb98b3","sha512":"b847b72d58d81155563bad5be3c1c739cfad94a7f8fe8cc902524150bbb7b70b05b1da9d23f138aeef5fecc9224cde8ccaedcc10c1e0b9b84576c07015921e6f","ssdeep":"3072:9aFtRkGM0S0DyESCwI+jwhnU1Ylmhoct1W:9d0GpCRhAYgS0M","tlshash":"2cb3122cd3d845904da493a9094676497fe8c338ec93682988f2369a7d14cedbfcd275","first_seen":"2026-07-19T07:18:10.093578Z","last_seen":"2026-07-19T07:20:06.940474Z","times_seen":2,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":307,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sofiasanssemicondensed/v8/46k9laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWM08g.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.730Z","timestamp":1784445454730,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/sofiasanssemicondensed/v8/46k9laPnUDrQoNsWDCGXXxYlujh5Wv0nwP4RwxURsWM08g.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://moonlightthroughvalley.icu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 41532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 16 Jul 2026 14:02:35 GMT\r\nexpires: Fri, 16 Jul 2027 14:02:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 234899\r\nlast-modified: Tue, 09 Sep 2025 18:55:11 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":41532,"size_decoded":42345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 41532, version 1.0","md5":"8d330c8a3c0bbabf1b096289020f0437","sha1":"d74832f123b6560a7dfdebcf0aa7a6304aa06731","sha256":"f00d908c2a2d0ecfa1f02b1bb1f6b14c68b6d63468876bb0432b731652371d4a","sha512":"65230197dca74f0671208bf92fdd5a966cd4f76f8bafc12f4b0d2bb19409af0069f5587a13850462dbae134e9de437b05e3719e74582586de4cd9245968bb9a8","ssdeep":"768:RkoypafPOhl+MyRnAkRP/h2ZdcdcH1IXKhRb6eoGUUKfX20Uen3ekLy:Rapa+yMdkRP/8Zdgy13hRb6eoJrfm0UZ","tlshash":"271302722336edd690fb8133abd95c9b00113026fce7514df972e62a7a19830d676bb1","first_seen":"2025-10-09T07:08:50.854813Z","last_seen":"2026-07-19T07:20:06.923234Z","times_seen":38,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":2,"connect":32,"send":0,"wait":19,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Teko:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.281Z","timestamp":1784445454281,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Teko:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 19 Jul 2026 07:17:34 GMT\r\ndate: Sun, 19 Jul 2026 07:17:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5915,"size_decoded":1225,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3f10bedc39eda6cbf7ae602bbea0ef19","sha1":"e9cf2b17bd6eb1c29363e65e70256923d9b34614","sha256":"9649bb87c2bb1b14451cab780887e6fb820dbc7118f982fd490d79cd663a8f0f","sha512":"03199b26951cd0ad5d5385b79a7516f972824581af431283a4c2eb5717eb427dd35efb4870c75b71504159db8055cb91f7a025f0e547faeeddc795f4f16fc6dd","ssdeep":"96:kO1a5pO1a5lJc+uGO1a52NnOEa5pOEa5lJc+uGOEa52NnOXa5pOXa5lJc+uGOXam:qRrNf8rAYDrnxGrKClr5z","tlshash":"d3c1ab91086b9008eb470cc263ce7f27ee0e32645460d9799ffe08c8adabc295355b4e","first_seen":"2025-09-20T01:05:37.333681Z","last_seen":"2026-07-20T20:16:20.446353Z","times_seen":436,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":33,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonlightthroughvalley.icu/lander/surniximin_ru_wp/logo-white.svg","fqdn":"moonlightthroughvalley.icu","domain":"moonlightthroughvalley.icu","tld":"icu"},"ip":{"addr":"77.90.185.84","port":443,"asn":215476,"as":"Inside Network LTD","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonlightthroughvalley.icu/","date":"2026-07-19T07:17:34.879Z","timestamp":1784445454879,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"moonlightthroughvalley.icu","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Jun 2026 17:51:01 GMT","end":"Mon, 07 Sep 2026 17:51:00 GMT"},"fingerprint":{"sha1":"12:30:0F:A2:10:4B:1E:10:E3:8B:1B:81:6C:38:2F:E3:D6:B9:6B:FC","sha256":"2E:7F:79:0F:62:35:BC:B4:2D:37:96:ED:D9:DF:F5:B5:3D:2A:3E:2F:FD:04:23:15:C8:58:5B:1D:3F:02:B9:22"}}},"request":{"raw":"GET /lander/surniximin_ru_wp/logo-white.svg HTTP/1.1\r\nHost: moonlightthroughvalley.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moonlightthroughvalley.icu/\r\nCookie: _subid=18uumd01eleq2; 7a069=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIxNDhcIjoxNzg0NDQ1NDUzfSxcImNhbXBhaWduc1wiOntcIjcwOFwiOjE3ODQ0NDU0NTN9LFwidGltZVwiOjE3ODQ0NDU0NTN9In0.qXxVjAoEPXE9rocFU26GDFEPEobYAjXUpbnrZWCeB64\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 19 Jul 2026 07:17:34 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 3603\r\nLast-Modified: Fri, 13 Jun 2025 08:13:30 GMT\r\nConnection: keep-alive\r\nETag: \"684bddaa-e13\"\r\nExpires: Wed, 29 Jul 2026 07:17:34 GMT\r\nCache-Control: max-age=864000\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3603,"size_decoded":3942,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a97adf86152101b34390b38cf4d0b914","sha1":"46d0f78921666915f83f379c3c2e9417b28af49a","sha256":"7f92a93e49ff6e3810b8097621f36f53f8520aeed880005f1c28a79451c003a6","sha512":"6ac5233c9d95bf03894a6a0d0c24ee7145849c4c35eb63db91e9afa5c950028f2cb0e348d4b18cc97e6d574abd852fa12d6bdbccdc0c31534b3ced4618db28be","ssdeep":"","tlshash":"8571747a0318aaf7058787c5cbfa709722a161e6b29ae0dcebd326275c01df70174975","first_seen":"2026-07-19T07:18:10.086241Z","last_seen":"2026-07-19T07:20:06.934011Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"moonlightthroughvalley.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"moonlightthroughvalley.icu","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}