{"report_id":"0e88b46e-348f-4700-a2e8-5921b3d1f3f6","version":6,"status":"done","tags":[],"date":"2026-02-01T14:40:25Z","url":{"schema":"https","addr":"claim.moonbirds.cc","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"104.21.74.139","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"claim.moonbirds.cc/","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"title":"Birb Website","dom":{"size":36993,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20519)","md5":"da88a70f3049002f92efc18d3a996b09","sha1":"d7b14cd718d3b22105453afbe33a7cf2781c1bb1","sha256":"1a0e1f25632aaa2ffb1ef6a92ff226a9e63c8f9e5350f100e171bc86c8d3140f","sha512":"f768038c4e6df1c9f2b08c62467e12df69b6bbf11b62e6c829e228d60285e918a3348a6f23f1df777653823750efba223fd6c3695ffcc93279eaf1354d529a0c","ssdeep":"768:HhzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPROHXL0hDgmwcm:BzqyrY8vomu1jS9","tlshash":"f0f2441cf5108e3f361bd6fe11d0eedca1503215dd27aa4db2f89093ea8adb309e5924","dom_hash":"domhashf8d79f05bb4d3d5fd539bffdd0c04092","first_seen":"2026-01-31T19:30:19.847956Z","last_seen":"2026-02-01T14:40:29.208466Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"claim.moonbirds.cc","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"104.21.74.139","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-08T14:40:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"claim.moonbirds.cc","ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-30","domain_rank":0,"first_seen":"2026-01-31T19:30:15.132842Z","last_seen":"2026-01-31T19:30:15.132842Z","alert_count":42,"request_count":21,"received_data":3358986,"sent_data":10004,"comment":"","tags":null,"fingerprints":[{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-25T22:17:37.642954Z","alert_count":0,"request_count":1,"received_data":10794,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/index-B4s03UYB.js","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b13fb268169702917f5391860cbabde4","sha1":"fc451db4ad188c53d22cd8ceddcead1d692dabe1","sha256":"d32cf98bb5414a09cf3230903e44b81134daf787364bd31c4fdf6ab60c6e0b08","sha512":"ff47b50059ed8513f264b0319d049abb0ae500154e4ab87d5f30c14c969c698983a6b52df235dc3ffd9d933d900a7fa67229554f21ff9c6f3704f6a745fa60bc","ssdeep":"3072:OA4boVNLUuPyXhXlDEPMNuuTaMEHBpGtigU9Eoyj8YAH0jN1h1cUEGRYDFzRaJP7:OA4boHLUuPgNj6BwttASH40b","tlshash":"9284939c66f62931a123e03a4a6fdc857635a80b034ddd56398cd564af1843887fbfec","size":380608,"data":"","first_seen":"2026-01-31T19:30:19.891117Z","last_seen":"2026-02-01T14:40:29.232179Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/_nuxt/assets/index.js","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8793047ddfdec5645905e4e6ac19c68b","sha1":"10ce6cae8e5e760df5b267a79f04c5568bf7b7ef","sha256":"c00269ed32fd2afc09ad9fa1dfd99eb1d425e2ac1ff9f35b9e4a54d19244988a","sha512":"e8d611a83befce1d798f688638b41b9da0358563e10f9400eb33996f81908d1bb7f39ccd943023f134a61461abb39bc2741edd68c9ac599f0e1e3edbc1176731","ssdeep":"12288:pGe10G1c6xlhM03xC0PBycF/W3rBvB8EVqGunvn4RrfLr:pGe10Elq03s0X6bO+jLr","tlshash":"3be4d67b314de0abd5126ce478a71c772cebd44bdc9f0c3961e5e85d93308a2a35ae90","size":708233,"data":"","first_seen":"2026-02-01T14:38:44.840409Z","last_seen":"2026-02-01T14:40:29.242989Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"40ab89fe8054907d9713402873aed106","sha1":"2a7b8dc5b210a205c7ba448a86b1302d04ed977a","sha256":"9095c0cad3d28ffe05931f876f298cfd4a3479282996eab96ac516da2ae9a69f","sha512":"8bb0c1fbe9c44fa8c73fd4cbfdf706b66d18d5137df484570dcba07c5e8e0ee7b8bfc6229f2f52b29dd57e397eab4da44509a76727eddd422032850cfb2d6338","ssdeep":"12288:CKmC01cyjNmUjaQfDOwF/kLz/aevaWIl8v9:CKmCgj4UeQ5atMKv9","tlshash":"ebe4d53a314de4bbc61641e57c6b0cc72cebd84bdcdf0c2465f8d16e97349a2626ba90","size":680268,"data":"","first_seen":"2026-02-01T14:38:44.837209Z","last_seen":"2026-02-01T14:40:29.244229Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"claim.moonbirds.cc/","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-01T14:40:03.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U64Knm1YwwDCFzjNB6ux7%2FwoqjVYlZyLWF795LnzwaW9AfgluVHfXpNGCOXDvoz1wQUODU%2FufjXSgXGs6BC77ro47uw7zBgsHJ90C8DMCvhUEw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c7233a48b8cb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":477,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"d4387c3fbcf63d1d5b0522d5254d7c66","sha1":"1c2a4fc0c932d2814c554aed812429397bbbbc99","sha256":"82b50754f19e849259b6ef886b364e805b96b39a66e7bc563ccf2ab9fc23ff40","sha512":"41c1a267e150ef807d160f0dc1546408bbb912f6bd9840d5d6233940907da72485466f1ff0083190d317c6ef8abb7956bccbd1036ef2299b0fcc9906a91b6c54","ssdeep":"","tlshash":"f2f09e026c04c505037829406e603c4805e69f94da42fc4441faa97aa5ddb85cc5e9f9","first_seen":"2026-01-31T19:30:19.886492Z","last_seen":"2026-02-01T14:40:29.213213Z","times_seen":2,"resource_available":false,"data":null}},"time_used":389,"timings":{"blocked":43,"dns":28,"connect":1,"send":0,"wait":297,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/birb-logo-DV5lYuCV.svg","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/birb-logo-DV5lYuCV.svg HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\ncontent-encoding: br\r\nage: 69010\r\ncf-cache-status: HIT\r\netag: W/\"697a62d4-186d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BKJL%2BY2kEjerr0p9Nt4e%2FPZvnSCJHS98c33bNFtr0Rh8F3GHlDxlqSFdXD%2FfHeR7tSWB4B76tmCHY6sNvzffbbaCZhqm1WPw7OJSBd3GvZE%3D\"}]}\r\ncf-ray: 9c7233a89da7b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6253,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a8d7c1929a44998ccd7e1a4b9e079d16","sha1":"c835828fc0ac590b9b590ab8d2b46649ecff71ad","sha256":"0f19c957bcf992aee58519f73abaaa913bb728623240c4ccafff5b91a6351b91","sha512":"0512f4e5c224c45b7faf9e9c78e7218ce8a3974f5350412cf992876404479901b8bbf4f0784b29ad34c6095228368dd2c001fd4521d06bb21fdf5b0c16ec1e4d","ssdeep":"192:aCG+zJguJ/o2aaqGpzHH3p12O1zjfVml0dzx:aC86tzZJXp12OpjCY1","tlshash":"17d14fecbf911cc58a498bd18d1252b03b4b557f6f864720c1a0e7b0b81acbdd9d1eda","first_seen":"2025-11-10T03:43:18.314526Z","last_seen":"2026-03-28T08:16:40.895122Z","times_seen":12,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/birb-logo-DV5lYuCV.svg","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/birb-logo-DV5lYuCV.svg HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\ncontent-encoding: br\r\nage: 69010\r\ncf-cache-status: HIT\r\netag: W/\"697a62d4-186d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VaE3K9DgGVgygSMwUu2HC055u1ojacKVXsJ9R3iwvkttNSrNGwB8MLcSLdq%2FF99xbN11ZNJsx5sL1HO3BR6yqzQ3cI%2BEVsU6qRDfwvoFBZM%3D\"}]}\r\ncf-ray: 9c7233a8cdaab51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6253,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a8d7c1929a44998ccd7e1a4b9e079d16","sha1":"c835828fc0ac590b9b590ab8d2b46649ecff71ad","sha256":"0f19c957bcf992aee58519f73abaaa913bb728623240c4ccafff5b91a6351b91","sha512":"0512f4e5c224c45b7faf9e9c78e7218ce8a3974f5350412cf992876404479901b8bbf4f0784b29ad34c6095228368dd2c001fd4521d06bb21fdf5b0c16ec1e4d","ssdeep":"192:aCG+zJguJ/o2aaqGpzHH3p12O1zjfVml0dzx:aC86tzZJXp12OpjCY1","tlshash":"17d14fecbf911cc58a498bd18d1252b03b4b557f6f864720c1a0e7b0b81acbdd9d1eda","first_seen":"2025-11-10T03:43:18.314526Z","last_seen":"2026-03-28T08:16:40.895122Z","times_seen":12,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/tiled-DUQGwgdV.png","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/tiled-DUQGwgdV.png HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 106410\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-19faa\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ynaR3e9dOVfLRMJkUF9VELNg40IUzt2Q8LL7bQtB90C1oxAMflz9bz0ShbYRtY9vNUtxtA7INK6WrGecscKi2NZeq4m%2FvnpUgievxlsVobI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a8edadb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":106410,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 952, 8-bit/color RGBA, non-interlaced","md5":"d044840830d7122c99c27bfb58182294","sha1":"1b7823f255df859038ad301d4c206d5ffe2d6f8e","sha256":"2cf11eceb17fc01666993b997d5f6fcf9033fd060a95b8cda3c94707ecca5911","sha512":"bd6dbe06efff9c9edb2c9ed064081e220b10b58ca858b367d3ace6862d0da6d4aab67afee6f96fec4fdcab3e7b5083d60075c305fc4ef3651e29d0ded3460522","ssdeep":"1536:h/G7jUOwIfjtX92x1wg0F/Lvj3bf1Hf6Geaz0AFliniz4EY/L7+59DhxVwHT2b1:hG74Owyjtsq9jLf16G3h/27AF7KHTq1","tlshash":"cca3025d852b9056fac40631cf9b90c21d20b7224da9ad2aadf9b8340ba1dd717271ef","first_seen":"2025-11-10T03:43:18.27928Z","last_seen":"2026-03-28T08:16:40.89791Z","times_seen":11,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/Pridi-Light-D0Yzg_Ji.ttf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/Pridi-Light-D0Yzg_Ji.ttf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 185828\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-2d5e4\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DBLcFFn3rL3O9vRFIt7M3QYegHTjmMKOwNKk9f1fjpbKdYYpuHWqPLgPKtt1cwmaXBdhgBIsAlUp41joTJCFPNoNehkCrSK1Kb20x7nuf3Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a90db1b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":185828,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 15 names, Microsoft, language 0x409","md5":"9ced6fdf3cf35f5011a9422d5bec4dd3","sha1":"8f5d81a112d1962ee72938d3d3132562e4e9abff","sha256":"ab5ee86d9c1ef248a336eb04dbab40a1861fc825896247e2e228afa63ccce202","sha512":"c7e7daf57d31ee93036929dfabc7dac2cee334580f767bcaa99dfa65136fcd0786168d17ac18580bae73919c2efeaa4cf2d1a363f4e320fdbceeee064763e1fd","ssdeep":"3072:YI2VuZpWF7NhjXXM8FgRJmBv9aa3zDbOOZ6zUNyhoZtxsNW:YI2VuQrjs8FgRJQA4zDbOw6oZt","tlshash":"95045c0bf7f7db44fe5f4f3912b623bab17af52b592f424aa2056b12d4964c00d482d2","first_seen":"2025-10-27T14:18:11.479392Z","last_seen":"2026-02-01T14:40:29.219183Z","times_seen":3,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/Pridi-Regular-DCDrgIXH.ttf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.015Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/Pridi-Regular-DCDrgIXH.ttf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 197124\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-30204\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5bzngZY8Dy7MU0OZRdBBq2SoAo8CsvrYa1VVmd%2BaCPNqFbh2LCOL%2F3%2BPszzN8rFGix9m1DmcDL5pSQWzauJkZFxvEBJLM8%2FlFYQ9l9qvJhU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a91db4b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":197124,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 17 tables, 1st \"GDEF\", 13 names, Microsoft, language 0x409","md5":"fe736a561ff24c7ed2d5097307d25b64","sha1":"d289ab215baa2a0b71a2fcecd83b295a7ea2d581","sha256":"a2c544c6359d51f5cc34b2fc51c196be97de7a054fb6564a610d817d6d388843","sha512":"6ab90155bb9e7fc02defa65b7b50ccc7181cf3af9cc253d2a3382bace763158ccfae6beb4ab7f48e9ee283f3483f08192eaefff11f7a1554635c0aa007571915","ssdeep":"3072:X2KrW7N0Zd/BwRzfgK5hP38QDieEec01ojqc19qcSxZSxD0XSr:X2KUO/czfgK5hP38QDsr9jqc147xZHK","tlshash":"ff144b07f6e7db54ef1f0e7926b613bfa56af12a193f824f62113b56e4924800e492c1","first_seen":"2025-08-04T11:37:23.479623Z","last_seen":"2026-02-01T14:40:29.222154Z","times_seen":3,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:38:02 GMT","end":"Mon, 06 Apr 2026 08:38:01 GMT"},"fingerprint":{"sha1":"00:CB:E3:62:3C:86:A7:11:87:F3:A6:90:20:C5:3B:40:22:3D:A4:45","sha256":"95:06:BF:37:D3:97:28:E3:54:05:91:BE:0D:2F:72:C7:C5:B0:4B:1C:FA:A1:FF:85:13:D0:DE:4A:8F:A2:55:1D"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 01 Feb 2026 14:40:04 GMT\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-08-13T16:53:52.679148Z","times_seen":40337,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":137,"dns":1,"connect":27,"send":0,"wait":44,"receive":0,"ssl":105},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/index-UIcSiLud.css","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/index-UIcSiLud.css HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: W/\"697a62d4-bedc\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\ncontent-encoding: gzip\r\nage: 69011\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KqZ2fAbZjvb5WJA058w3RUkJGEvfIpd0lOXUb3IrGji766dWLXF5%2Fksd%2FYlaByl4tZN5jMHBS1YlAEgimRcswDOYzTpuDExAPO%2BPJwE%2BVFU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233a80da5b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48860,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (48859)","md5":"5d82ebd94dd572c8a9d5cb7f914dee8d","sha1":"b298acad8c7b6e065a395ff2dcab3f741c385f4c","sha256":"2d4b75bed3a338809ca7a246ad1f09e752f97814651d7bbe9a1e86f78985a7be","sha512":"130a84516f2c424b96c26760348637de4db03ec809cd1882b1fd8fa9f830b32cf4ec6888ac9a817cb9d24497878d8b1d9ac2a501df540d13d538c45f1a757c89","ssdeep":"768:9IS8zCahx3igBqjRO+XN1dJLh9C9ZnOrdFGJtrSb59qVZx1GrdF2JlbiLRdtlVtm:+S8zCah78O+XDdJLh9C9ZnOrdFGJtrSe","tlshash":"ce23cc997a0cd114be430b6362df3e0865357688d63009cafe2a35c61cc2de67a77f69","first_seen":"2026-01-31T19:30:19.852462Z","last_seen":"2026-02-01T14:40:29.225794Z","times_seen":2,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/ears-_g2N-GFb.png","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/ears-_g2N-GFb.png HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 23286\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-5af6\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WH7hiXlUcPZymVdSOvlODcufozS1LD7NgGI5yuwnBo3x05uufMwcLjTJrybpl5XCq05p%2Fwol1ULpCI4Tuxxie1CQnPF7zf0%2BuU8xnkju6iY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a8cdacb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23286,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1861 x 642, 8-bit/color RGBA, non-interlaced","md5":"782f522392fb5a1266d2347ba72c6689","sha1":"ac5bf6e7123ef3a33e69f54f9ca9fd43ebc15954","sha256":"d306f99845fd70d744a9cbb90155f36ec059f575386d609c3860ce6b8012569c","sha512":"e3ec3a3a5b88247dbd682bdf2120c1d2da8cdd526d98e701588a9a56273db52fa71caa17006385df646e55f4ddfcd2020388eb4b176937aac294ccd33a1b027e","ssdeep":"384:uOKx3W0kOb8jHjKOQeUGASXz4Gtjl1mR2yigQczupUAIvdxIatM:uB5PG2OQeioTpSR2yBpAUAI15tM","tlshash":"afa2bfceddb74ec0c24d47708f5d5781b2ba59cd07548f6ea5b88632bcc86961f2aa08","first_seen":"2025-11-10T03:43:18.307648Z","last_seen":"2026-03-28T08:16:40.901075Z","times_seen":12,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/fonnts.com-Oscine_Bold-fIFj1orw.otf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/fonnts.com-Oscine_Bold-fIFj1orw.otf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 211984\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-33c10\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s6pw%2FEdU1dbLgzy%2Fc9tMlNUMYZjUSBfGKKiPZfXYz5%2BGh74tN5QAiBcTcAPWy6iI5CJZuhUn0ICnwHRd9IjsnDCXsFrstshA1ZwLS9HgiiA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a90db2b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":211984,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 19 tables, 1st \"DSIG\", 26 names, Macintosh, Copyright 2018 Dalton Maag Ltd. Modification of this file requires prior written permission from","md5":"f68973855dae44d499b719937ecd1724","sha1":"fcbb6e3774e0ddc688bff5e7ff6e6924bd252ad7","sha256":"50c31052ed2119c7f8dbb4b9711037dac4621a1b1f9910c25d1f8bf86b17b142","sha512":"457187fc61fec1ec67f15deb199190e42a7c73fac6fc08f5008090c12189c25c6415e4124a5ee8145da2dc4de6c39e151886c999962feaeca2d65df23ec5b40e","ssdeep":"3072:ofmt61MYky4OtkskMVyce1LB2Ly33xKmXWz8u:7cvHtRqB1L4LTFzv","tlshash":"4c243b1b7756e795c142ab7f85a1e2312bf03c032b7ea20ff547ea69f8970848d63581","first_seen":"2026-01-27T10:49:22.133254Z","last_seen":"2026-02-13T21:36:18.912359Z","times_seen":8,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/fonnts.com-Oscine_Regular-BGnXrCdx.otf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/fonnts.com-Oscine_Regular-BGnXrCdx.otf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 210180\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-33504\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Niw4bYFmNPOV1mclC0vfHRC%2FVIxDvPJn%2BQI7UJDpaiDKAYYoenb4eMLICTtCXovcrRT6ddBo%2FlUnfi%2BbQ6%2F9ONULNwVZhw690UgU15yePkk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a90db3b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":210180,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 19 tables, 1st \"DSIG\", 26 names, Macintosh, Copyright 2018 Dalton Maag Ltd. Modification of this file requires prior written permission from","md5":"1393231958731116d20ce676870a6522","sha1":"4ce74cf338c2812c8d8192fa04af9c447e0a129a","sha256":"195226ebb6136f0f56dafb8523275f552e0ee5d73b677852256faee3a386a922","sha512":"6acbf0485cd98d6152d319c9da300f3bfd03a0cc2f843b0d3d1113b98354c655cb60086241d5d90af2463b33ac0a80e46738f398dabc6596e9e862db6b59ef1e","ssdeep":"3072:mEP7ttWKIZGF+1D1HsY7npiO0IYjjZ2EuwIbZkHvT+wbu:mETWdfTMunx0IDmvawy","tlshash":"e0245b07b74aaa85c142ae3b5ae1d3316bf53c136b7aa20bf4479726f8274c4dc13791","first_seen":"2026-01-27T10:49:22.123295Z","last_seen":"2026-02-13T21:36:18.912835Z","times_seen":8,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/index-B4s03UYB.js","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/index-B4s03UYB.js HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: W/\"697a62d4-5cec0\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\ncontent-encoding: gzip\r\nage: 69011\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K6l9DbsqzJ9TiyuDZohU5teZUvwGIyM8bXHBcXGV38PXqee4lzPws%2BdpvL9B%2BVAx%2FIImPydMnARmsgymmps3etgXhJfVEwe3nwpNlOb77LE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233a80da4b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":380608,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2971)","md5":"b13fb268169702917f5391860cbabde4","sha1":"fc451db4ad188c53d22cd8ceddcead1d692dabe1","sha256":"d32cf98bb5414a09cf3230903e44b81134daf787364bd31c4fdf6ab60c6e0b08","sha512":"ff47b50059ed8513f264b0319d049abb0ae500154e4ab87d5f30c14c969c698983a6b52df235dc3ffd9d933d900a7fa67229554f21ff9c6f3704f6a745fa60bc","ssdeep":"3072:OA4boVNLUuPyXhXlDEPMNuuTaMEHBpGtigU9Eoyj8YAH0jN1h1cUEGRYDFzRaJP7:OA4boHLUuPgNj6BwttASH40b","tlshash":"9284939c66f62931a123e03a4a6fdc857635a80b034ddd56398cd564af1843887fbfec","first_seen":"2026-01-31T19:30:19.891117Z","last_seen":"2026-02-01T14:40:29.232179Z","times_seen":2,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/ears-_g2N-GFb.png","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/ears-_g2N-GFb.png HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T16:51:58.475838Z","times_seen":17873861,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/bird-JGSjaMfa.gif","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/bird-JGSjaMfa.gif HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: image/gif\r\ncontent-length: 837652\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-cc814\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yMVdUtvDPqaEbu5P1r3L7IYLBPRxEpCqQtSs53zDRv%2FZBZVMrxgYLrxF%2BdsQy%2BqjNyfCK0ehRaxGXPMZfs9Q8QCXJ6a6N0Gsxog96MXG5S4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a8cdabb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":837652,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 864 x 864","md5":"7eb7cef536f1951f115b6d8346638408","sha1":"0e14654e9e1d34c89b17e59523dfee385ae7d766","sha256":"d05180095883f91dc953932b14738369283f297d5fbb64fab990c7378b0f42f2","sha512":"38869cb2e9a91305fc97af3539f91b357654357fea08b3b69e0ca699da728d6059ee3843c575e285976e30d662b7e8c2f8aa2626c42a71267f720dc5d21cb357","ssdeep":"24576:tg9NbvPIX8LVwu7T3HBu+ona+bvPIX8LVwu7T3HBu+onXy:tg/QXmwu7jmQXmwu7jx","tlshash":"bf0523e4c61e4ea06f7063b45f47e710136b5bb7d49c7366deac590e4129238ceaa3b0","first_seen":"2026-01-27T10:49:22.128511Z","last_seen":"2026-03-28T08:16:40.896736Z","times_seen":10,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/fonnts.com-Oscine_XBold-B4aiP77G.otf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/fonnts.com-Oscine_XBold-B4aiP77G.otf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:03 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 213760\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-34300\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yLnVTqpzWnxvtBKTgV8sGcJgn%2BTEEn7a3ZGuVZhLdZ7sxuOhrKG8AWrizMcLrL3ppThiW4CjEZF437NsjPWFUtk8w7Vl6W7QMSmo2dTJVPk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a8edaeb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":213760,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 19 tables, 1st \"DSIG\", 31 names, Macintosh, Copyright 2018 Dalton Maag Ltd. Modification of this file requires prior written permission from","md5":"95413240643a2b98e076bf5579e80d3f","sha1":"f05f45bdeb8953e5448f7ce1d937d162a32c312d","sha256":"dc69393453f3fb531ddc682891c25225bdc442cc45f041f8e30d731c308b41fe","sha512":"088ee1fe4eb1342b711598b7acaaab30b6c4d15378cc2707574151592fc13ce63fe22e51ee76bcf6ac9c1df7b64e40c571d6775e45a32f90e7b3b9369e03101b","ssdeep":"3072:2dwEcjMyXOQEvbOms93okL7LiHnUHnQYnY1wiVof4DRK/oJOu:2dwryiokSUHnQY6VVNKcJ","tlshash":"28242a067746a695c346aa7f85e2d2322bf43c032b7ea207f5575b3ef86b0409d97242","first_seen":"2026-01-27T10:49:22.140715Z","last_seen":"2026-02-13T21:36:18.908692Z","times_seen":8,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/fonnts.com-Oscine_Light-DB9ymnG5.otf","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/fonnts.com-Oscine_Light-DB9ymnG5.otf HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/assets/index-UIcSiLud.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 204648\r\npriority: u=4,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-31f68\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69010\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fg6%2B1SMAwijkTHP%2FN3YnsFhVa9ly0gy%2FzpTjiAkF7H0aK3sLswVkRIOiLNmSnPnnYcYt1qS1RDv5LdHGt%2BuWnryFFmKiW94LxTQ7CAcYSMo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233a8fdafb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":204648,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 19 tables, 1st \"DSIG\", 30 names, Macintosh, Copyright 2018 Dalton Maag Ltd. Modification of this file requires prior written permission from","md5":"21d00eb1c895dba438b058c34490a857","sha1":"8e82d29a2511f6ff584e6662152fc42e8aa3e4b1","sha256":"2d608649470a7a3c503dffc82942e0539d7845e046bbbab190d2517e210ae5df","sha512":"230f503eebae1c72325d7ffe1a9a48a7439dc25db25267fe41c85c0008b27a6652481f61e656f8ab0943abe06b0ed8a999ff91842cb1d69e52a4f165a4641a88","ssdeep":"3072:LlrUC5IqTIBx5Mr8FD1UaZMK/qLeRSs9X4EQo9Keu:LNp3IB3lm4bHS8XB9w","tlshash":"0714290677066a95c706b93fd9d1c3327ff47c532b7ea20bf1479a29b8ab0409c97582","first_seen":"2026-01-27T10:49:22.143091Z","last_seen":"2026-02-13T21:36:18.906501Z","times_seen":8,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/api/visit","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"POST /api/visit HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim.moonbirds.cc/\r\nOrigin: https://claim.moonbirds.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:05 GMT\r\ncontent-type: text/plain;charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m%2FpEmE9RcsS%2BMhxkVDi%2BR1cJqpWwb0hRNjOtDwdgN6PD0N6K%2B%2Fhrt%2F8ou%2BEp8sr7N3uByGgWvl8AAgRZxa6BP81pSjeF4Rz75FxZLVF1MOo%3D\"}]}\r\npriority: u=4,i=?0\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233ae5dd1b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-08-13T16:51:49.595479Z","times_seen":448275,"resource_available":true,"data":null}},"time_used":346,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":346,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/_nuxt/assets/index.js","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /_nuxt/assets/index.js HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nlast-modified: Sun, 01 Feb 2026 13:41:25 GMT\r\netag: W/\"697f5805-ad3cd\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=300, must-revalidate\r\ncontent-encoding: gzip\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zt7U%2FEDS6QJuQyrDh3BJQMf4uHVXbPdmCQKNH9I8%2BhIxBtvgHxJkkUYj8S7gJQtP9zXuYxCOMj2sLj%2F8DO1%2B4nUwNrAPum%2FURyo3NgKtfPk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233a80da6b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":709581,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (55668), with no line terminators","md5":"1bd5a3f0994ad81d12661c08fbd02651","sha1":"5e907b6f187a55c3a783f53afc5834c8b3652ca5","sha256":"f2b9d5743f71145807b07ed6a9d848d06a92164ce19e6daae5cc82bc36aa84c5","sha512":"5e9b3e60c34fb35fef56711dbc5591b51c2f48f081930cd0512af8846071531afaa3d7707c61a5a552cac0b8d736f50e02715193735aeca4b0f80789296401a7","ssdeep":"12288:pGe10G1c6xlhM03xC0PBycF/W3rBvB8EVqGuzaQtWQrfLr:pGe10Elq03s0X6bOTjLr","tlshash":"15f4e677314fe2aed0126de438a70c676ce7d887dc9f4c39629ae80d5331962a31ed94","first_seen":"2026-02-01T14:40:29.237534Z","last_seen":"2026-02-01T14:40:29.237534Z","times_seen":1,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/bird-JGSjaMfa.gif","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:03.951Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/bird-JGSjaMfa.gif HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T16:51:58.475838Z","times_seen":17873861,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/api/config","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim.moonbirds.cc/\r\ncontent-language: en-US,q=0.8;en\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: text/plain; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YmJXJXa5iBuGJOTikeVRtY8mEuoQBm5M1wRHsbYaSdm1nhQPoWXoBTDv7R929iRc1aQxTpGiXIjZ0zVXRU9k4g%2FyzgBsyqI7xfbrUIyZO2w%3D\"}]}\r\npriority: u=4,i=?0\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233ad0dcbb51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":248,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"data","md5":"0a1a104f00f50bcb6356d98b7eed25e3","sha1":"e8e82a0ef9b900e77263184a5e8106453cb047d2","sha256":"dc2abc9056f24a74b9157f450e1ba45cf7ab3a4c1b00577c26d0e139c7c51804","sha512":"e5179a09d9c5ec4423df90401f464ff40d15e4804225c150454bd3904efce84a9906bf88214c8d9db334664af193f0e924dad23529841ec55ff074bc44c89d77","ssdeep":"","tlshash":"f9e0c0db8e11c083e321a407301a5175e52275e2aba9ba80511ac5536200e80f4ec6f3","first_seen":"2026-02-01T14:40:29.239244Z","last_seen":"2026-02-01T14:40:29.239244Z","times_seen":1,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/api/is-banned","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:04.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /api/is-banned HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim.moonbirds.cc/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:04 GMT\r\ncontent-type: text/plain;charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qQ78BCFdS5m3PBx4KffYTv18AFsqC4%2Bt9GhetN7s3XnVQ25UZSdXrujKYCzPVVtTfUS98DO4xBc7P37U1al5cYbRpA9W3fffsIG8%2Bc0Vj5I%3D\"}]}\r\npriority: u=4,i=?0\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST\r\ncache-control: private, max-age=300\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c7233ad0dcab51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-13T16:52:09.46269Z","times_seen":119361,"resource_available":true,"data":null}},"time_used":328,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.cc/assets/favicon-zQGsYglM.png","fqdn":"claim.moonbirds.cc","domain":"moonbirds.cc","tld":"cc"},"ip":{"addr":"172.67.158.249","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim.moonbirds.cc/","date":"2026-02-01T14:40:05.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirds.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 30 Jan 2026 02:24:21 GMT","end":"Thu, 30 Apr 2026 03:21:56 GMT"},"fingerprint":{"sha1":"31:C7:A8:B8:65:96:86:0C:0B:2B:EC:E9:7E:AF:F1:76:C2:49:69:6A","sha256":"2E:3C:86:EA:F6:73:38:0E:CE:7C:0F:DB:D0:8B:F0:6E:AE:0D:24:E7:FE:6A:63:38:86:DA:47:56:DF:7B:E8:0D"}}},"request":{"raw":"GET /assets/favicon-zQGsYglM.png HTTP/1.1\r\nHost: claim.moonbirds.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim.moonbirds.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 01 Feb 2026 14:40:05 GMT\r\ncontent-type: image/png\r\ncontent-length: 1842\r\npriority: u=6,i=?0\r\nlast-modified: Wed, 28 Jan 2026 19:26:12 GMT\r\netag: \"697a62d4-732\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=864000\r\naccept-ranges: bytes\r\nage: 69011\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xqXU1zsI8mmp7Kz0eLXg8%2FjiZ2fDBM7mXVO2%2FKrIy3QwpeVzjvnzliO81dHbYu9cH669LjBJAjWvgYdVwDz1hkYzvvA2Q%2FawXMEUlA5oLPw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c7233afbdd6b51d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1842,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 29, 8-bit colormap, non-interlaced","md5":"fb2372d7743fbfe770f569bb2f6416dc","sha1":"cb5fdeab16c460b9bf5a1a3a2872ffeb9a682aaf","sha256":"bc0d7d1694f476ef9bb686adf7375e953fb57f82e973138c6809fefe8d916937","sha512":"6f6e227bae54e9d5b540af0952e9050faa3d2d2da37bfeafa22f7f3348bbce4adb6951189948a726cea695c30c97bfda513e2848f2f1af771436cf5e7cb81748","ssdeep":"","tlshash":"4231457d5073b3d6c55a523f83117984d9208e8c36e78b299c839be85c085515afbfd2","first_seen":"2026-01-27T10:49:22.126003Z","last_seen":"2026-03-28T08:16:40.918776Z","times_seen":10,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-01","alert":"Sinkholed","trigger":"claim.moonbirds.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}