{"report_id":"2bafda7a-4e82-4132-baf6-dc9ec84db7e8","version":6,"status":"done","tags":[],"date":"2026-01-27T12:09:51Z","url":{"schema":"http","addr":"airdrop.moonbirdes.xyz","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"172.67.172.71","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"title":"MoonBirds | AirDrop","dom":{"size":43009,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16074)","md5":"be0f1d5779ca6f67a46df334f5ea1c1c","sha1":"d6a392d44e365a7752f22f4803685e549af86cf4","sha256":"7f8dac90608baa750c6c7c6b4bdfe6584cf13751bd145270b5481508c88442a4","sha512":"800e7c62d7973ea2534e5eeb3e4ee5a14cc46c8b08556cb1448c6a7f75bad3daa7786a4979ab31a8dad06d20e518a72f1ae295c9d4d29dd8877ece111b498b5b","ssdeep":"768:KmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPROHXL0hDgmwcD:RzOLBKZJ/7PLwJvzoCxkU","tlshash":"39133070f450283b351ba1ef2ac28f6d76a6a456cc27660873fc8182dfd6ef69d63414","dom_hash":"domhashbc51b01f98cf7a3ac4444818cae6ca0d","first_seen":"2026-01-27T12:09:53.489879Z","last_seen":"2026-01-27T12:09:53.489879Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"airdrop.moonbirdes.xyz","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"172.67.172.71","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-03T12:09:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"airdrop.moonbirdes.xyz","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-26","domain_rank":0,"first_seen":"2026-01-27T11:12:43.357267Z","last_seen":"2026-01-27T11:12:43.357267Z","alert_count":27,"request_count":27,"received_data":2041742,"sent_data":13478,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"269184e3504aae95e2b0ce7666438b00","sha1":"a6802ee4c1021b344ee662a82068467329d50fd9","sha256":"2ab42cf0412a38c90d3d9ca5ac3f441f89a0db07f5e04ced3b3cca4d5f164f62","sha512":"e08b1f8d74ebbbad7f7a059ae8e0275d8bd6e9b94faf9bf9b2433b84a8be65e760962485bbb5be78cf36d6190ea356b4e2c14561557a80935f99105a52d99b5b","ssdeep":"","tlshash":"96c0120970746566048e786d08cf08897f268412610849c599dcc8547fb1e6942b084c","size":173,"data":"","first_seen":"2024-12-04T06:49:00.889058Z","last_seen":"2026-08-14T05:17:33.678588Z","times_seen":76,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"297a907d4e5b4c2198915e66274d9c9a","sha1":"e0f98af49ab0f7a270e2d739436181f924449098","sha256":"0fdbc26d9d5bd7f6a4bc38acfb91fc663c57463d43a08447f1386b3354cd84de","sha512":"48487cbd59e60a259a5836fc0315243da500d617e94e06b3073f79bb834bd141c9e5cfb59c42a3c2086c920c21be5996e589d4658513cf31d95bfc5757a4a44e","ssdeep":"","tlshash":"1371bc3beb00173bdc8fb9fdced5b4c02e62497262496560691ce102b16cd7087bed88","size":3741,"data":"","first_seen":"2025-08-14T22:39:51.132287Z","last_seen":"2026-08-15T18:29:27.711588Z","times_seen":3242,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/expo.plus.umd.js","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d6e766f86dddc9309f038984cb455d5","sha1":"5c48eb526660faab3b19b990d87cdac1dcd64cb6","sha256":"996565832f7347a13905fa90dd612fa618d64bce518aa8d645c54cfdea91fabf","sha512":"fd8b17e9cd28707bf33be9f4ae9a7ec7416d5abf2497431977a0997620eacfc98d3d62cb7d6679b9b2a9dcc0c3bab0f4dea6ce5229c0bc70b5d4938f79be7743","ssdeep":"3072:WHeWADq5XhlkXMPz6uEwLiEpLG/bAb5p0bGg4Pvg8k8FsUeaznX1:W+WADq5XheXMPQjEpPb55wi","tlshash":"96743eff098350bd823853db74a5c5b98efcb9524b882c2be7a55645f81066634e33b3","size":356689,"data":"","first_seen":"2026-01-27T12:09:53.495616Z","last_seen":"2026-01-28T19:43:54.417007Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f15c08ce1fcf3e1d653c2d02e562b0f3","sha1":"4048a30a2ba6254b4160f7fd072c068be16ce15b","sha256":"c1912cdcc3e977ed8552eb405c8002ee90dfac05a345a5f39caccdc98932fe65","sha512":"3dad10d5cd46ae45f8f0089211ae5a50b8e0ad14bf36c287b03eb2c7f9de92c909ecc743e0e4d5448a83c4fe627cccd613b10ae620781435e4fe7c06362630ba","ssdeep":"3072:IKjpOjdOZNqqYKJpm6QqACmj9wL/yX59MduGCPfeoy8FsUeaznXk:Ip6rh9mjJX5X+9","tlshash":"2b744eff098760bd823553eb78a5c5b58efcbd5247882c2ae7a55601f85066234e33b3","size":349161,"data":"","first_seen":"2026-01-27T12:09:53.511084Z","last_seen":"2026-01-28T19:43:54.420604Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7701841bc6fdbcfb07f261d5bf52459c","sha1":"4e7123342cdd41bec739044a14a22a924b4c8860","sha256":"ee1ed6046341fc3966c70f25fe05b608a99c7f310df24917c992fd45bc4ceaf3","sha512":"762e264a4bc85306014b44d180d863b9429366d2613e588e989bb0cdcf3deffd24d29269e1cee8e0e765a4c1100407787df79883fbc95b0845f3ff1ce4c3d36f","ssdeep":"","tlshash":"5e11482cb4f62272153b3139475fa38e3a7150933009e9093d6d8a910fe4e1a69a6eda","size":983,"data":"","first_seen":"2026-01-27T12:09:53.512626Z","last_seen":"2026-01-28T19:43:54.421392Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fdayjs.esm.min.js%3Ft%3D29491929%26u%3DyHbvCglwwSMI2ZDpGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGZjZq1_pbqJ1SHc3zpNCg","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c835ce0aa761a791b29ba4c102a85e28","sha1":"828e40328ca8ff740f1090e6f63e170c1592a62c","sha256":"4ee6631554867dc1bfadbfe5f4b4ebf4cec5164ba142f8db92f840c2028496cf","sha512":"49cefc3ca9614cebafe201eef12b5cdebcdd19da6ab30f530d7a81a8ef91fca5f02eb63108b8056c2dbd4c22b8b337aae939a712f4a876bdeef21a1e2a9f3225","ssdeep":"6144:9ujB8gltIeTM5/S8g6zRhNgDzQebuazBzqXQPkBAUvVdZcml4L:ihltVM/g6ZszQeqazNqXQcBvK","tlshash":"29d4bcec970a167788cb97b6423363afef884d1a236b3c406ec19cd1574a74e53ea15c","size":641034,"data":"","first_seen":"2026-01-01T19:22:06.925398Z","last_seen":"2026-03-30T11:52:16.142566Z","times_seen":405,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0HiZBuKNFWwcDdkki2%2B%2B2gKjObLQ3xDHp%2F3hWW3z38IEq6t1IMdlH1Lt0K%2FkZJRmtxlg31kVgaidkR6Ej7N1f4IkQ8uKG969uftOtH7xgcxFkKrtFxE%3D\"}]}\r\ncf-ray: 9c4824346a76120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/skfhx.css","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /skfhx.css HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: W/\"69784ea8-493e\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7nOA6VKVtjzX%2ByVb0kzURenPGlzvMly%2Bu%2BuwYau%2BkDPp8auCbI9fiP14YfP13odHvHCWEtcyGH5gEQMJPCOSrYrr%2FulWTN16o9pxXzu3PsfbtSNh4gM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482432fe1a120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18750,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"82aef9a3e1c80478f5323ae7a8ae7668","sha1":"7eb9f4a4d04cba5dca28002dada802abf4c42974","sha256":"5d3197ca298eb840cb43e77bf3fbb6c75bfa01280d4975ba225004c5da5c3934","sha512":"de21db733b730f86bd48a3d43aad885bd42e8166878800363d83bc4673165514a20753ac166c3ee70bb8667eacb69e9f6da7cc1a0c1eedc962318d9899b8fc19","ssdeep":"192:uS6ipGfMckARAjQl+7BNL8k/83Vt5uwrfaTcboz8Dd3AY5UtkJdeENMCKUC0hHv2:adDFuBJ9/GTjvd6bUHyV","tlshash":"018206d2276950247d3bf5582ba79b4db3a8e042990aca7d7bd4206c5fc93ec11e3b4c","first_seen":"2026-01-27T11:12:46.136264Z","last_seen":"2026-02-14T07:55:45.650736Z","times_seen":16,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/expo.plus.umd.js","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /expo.plus.umd.js HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 12:04:03 GMT\r\netag: W/\"6978a9b3-57151\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ml6glwsCRe%2BC1IkrB8YTpmJasAQX5xLVfzeMdWDgrFQy7p1dQoZyLxTtAuXOl0IzjikiESjpZhZATQW8xX3UVm6l%2FlJxKNSsLA%2Fx4dYT2zh0vmdFrgY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c4824330e2f120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":356689,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65159)","md5":"9d6e766f86dddc9309f038984cb455d5","sha1":"5c48eb526660faab3b19b990d87cdac1dcd64cb6","sha256":"996565832f7347a13905fa90dd612fa618d64bce518aa8d645c54cfdea91fabf","sha512":"fd8b17e9cd28707bf33be9f4ae9a7ec7416d5abf2497431977a0997620eacfc98d3d62cb7d6679b9b2a9dcc0c3bab0f4dea6ce5229c0bc70b5d4938f79be7743","ssdeep":"3072:WHeWADq5XhlkXMPz6uEwLiEpLG/bAb5p0bGg4Pvg8k8FsUeaznX1:W+WADq5XheXMPQjEpPb55wi","tlshash":"96743eff098350bd823853db74a5c5b98efcb9524b882c2be7a55645f81066634e33b3","first_seen":"2026-01-27T12:09:53.495616Z","last_seen":"2026-01-28T19:43:54.417007Z","times_seen":7,"resource_available":true,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":131,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/partners.svg","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /partners.svg HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/skfhx.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z3oy2QjcHEequUSSV1AcJZ6XC88H9o3xSl14xPmLoOXstaGzbGnWo21RSnOPi4c2BNw0SW9EHBVZ0Htmx05OkgVEbvKM8x9OoqDaA9WVzspy%2Fo8h6VI%3D\"}]}\r\netag: W/\"69784ea8-b2d3\"\r\ncontent-encoding: br\r\ncf-ray: 9c4824337f96120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45779,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7f22aa5a0907db8601fe547ae17fb8cd","sha1":"00ad41d4e8f817203378bdda7031d9efd978d86d","sha256":"f8ed2880d52516945036dc4c2c00894556486a2e74822a83928ee326a81276a3","sha512":"3c0007baeec55935b9c90c504f3ca754a4fbe10dd4c3464c1e4d712692db86f50207315a566767a49e7b7a4102919d2f72791aff8d3a7aaf2a27ed406f01516c","ssdeep":"768:9LcpJ31FycE22R2Qfk9vEodzfQu6qjo6dvTW4jVv:23y06ejQu6qLvTpv","tlshash":"7b230aedb7a562e0e844e7f59a2954b43f2b18fe3e16c724c2598f64f94105cc8d9cc2","first_seen":"2026-01-22T01:53:14.342559Z","last_seen":"2026-08-07T22:54:56.351291Z","times_seen":225,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H26rNbsEOggi1pgYKedRs4xuRFHyJd99Q8nl9yOykyduBMVPgD8a3BNbDaC8uu4ShetaBXFORmeDKVdfPA5TDjTlq%2B9%2BZn4zz5UlHdd6%2Fv8VKGweevs%3D\"}]}\r\ncf-ray: 9c482433b829120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3429\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2A9lLDN2UqT5%2BIKKW9Nn8Fjar4H161whGGPDLA%2BMamXosl8K7gimOeuChOk%2BIBU%2BYsLDGMQho2oRSOTsslXP0amCHJoVqLafljlLNV5lf8kua3SummA%3D\"}]}\r\ncf-ray: 9c482433b82e120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QMQ1lEq3p0OoLnHlujaUSf7P2T5W5GYxUlu8YEnwYAmp9udhp%2FyQ1FdNmAx9V2N%2B5%2Bw8C45XQdSBOTDTxuJKlZ4592iwfguZJKo7EyFVSvgw1klq3L0%3D\"}]}\r\ncf-ray: 9c482433d8cc120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/bafkreifesrdorgmwpy2zfrnzvqb5guc7petxirvf2v2vaxqntytmrwyyw4.png","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /bafkreifesrdorgmwpy2zfrnzvqb5guc7petxirvf2v2vaxqntytmrwyyw4.png HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 5394\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: \"69784ea8-1512\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 3431\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NNrgDwxEjjJzOtxxU1mrR2kxk5J4uRi2oEXNJhrTgQN4tMuKBSd3%2F1DmmxlgLpqt1ldWKV7lw81LQ7SGF0aNEhsCy5m6%2BQEjzOzmd%2BVJodrO3CBaZYM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c4824380d71120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5394,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 401x402, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"eef71258de7a12a58e89d1c68ef2e51f","sha1":"9e85a5060491bb5b0fbf1a9aaef60dab9db26e95","sha256":"f072f55ffb215073c0978c77ed3be187fec4a05c6c0e60b8ff93af31038a2518","sha512":"1285a7ae2bf1b1a461930421a28bbde59f5870ce8eb56024d42af3b3cbd8200f2483c63a1c94162209b4fdf53f58dc7a4fbe83dcb9d3a69fb7366aa5005615d0","ssdeep":"96:bc9zQiAcqa5i9427nNZAtmWdFPFcjUI2uwOpT44H6jJ10khmd4nZAhwusX0+b:46b/f9xYtmWbFc/2IT49jztHb","tlshash":"b8b18d070997883a3c8b36afdd7006644304896f9e385bddf466c732862da53062ed9f","first_seen":"2026-01-27T11:12:46.141967Z","last_seen":"2026-02-14T07:55:45.650171Z","times_seen":18,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz//secureproxy?s=%2Fjmpd%2F","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:31.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"POST //secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://airdrop.moonbirdes.xyz/\r\ncontent-type: application/json\r\nContent-Length: 2212\r\nOrigin: https://airdrop.moonbirdes.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2212,"data":"{\"route\":\"8XUwkBv9vhPYfVpD1fxb7EC65sUXJdqr\",\"payload\":\"GAQgJmiJkX8CoFXfkGNckYP1A1zQUv6qiamn2yJWTXjNkwBBimFmGgVZ4MnLB8eL5Runtakemi1i86ZUAa5JpqY7hU1K63pomJp9BAjviu9LF9sSXvkkESC1tiYgr2dNVTqmq9fSd3K8vpnzFPbhGiZzsa7YSn8SCMGjr8Sy7xrY1coMNxd1NMsuyvRx1TpSCyr8HCT6CrsRbnF1PduvgtAmiEXvHUUgkMLsNuCkoJN3yG3kHByGSfcproE9NovjmFiwqD3jVmgGe5f1iaYCMYQyccxu97aMhQgtWSv89rUQ7GRqgs8os5noheFgiwstbTH34bSBcDqAtHNcCnsxhRd5oSABGyq2ESBpJAWzWhM39dJYUdfd9VnJmZRT8dfXTyyxnL8cDkc9ToVve1as5AkiCZcgwaF5ARavbxbfMv2TMn6x8c3f3pzSiFYr6M2aNR76o8CGm4kghiHFZ1aiaNDzvQGK6dNjrQf5Dq1qrGN5qCHxLVz2g4b93dPHXqpudCaqYh5CWX9FqATEduPvbkuTLzFpfhJFh51P7B4reS1KoQnMoiE2PcCd9VUG4ExYMzFfkqR7Tw6q5hyzRFd7jVj5nt6uVdWNo7oexaQaj4cEcnaggMS1e1YCtsNorgvU94Sav1286dyCUvrhZme5tThEsXgkTdnWbStRP9EXCcgYsa2Z1zKqkWiHo9b3TK56txrw51EPep3dAN1gdKPCXAoQF9Zn2KEcT7LbCRRV3vY4J6haByqHF1eX9SfAxpYDzkHUDUbMsHmbKHJgf7uhNDv15DFeRneyqcymng4jJJxhk19yq2WqTo2cffLZNyVgznupR3pk5hQKpc32bvFv1gAx3U1MbzJxLqEG5kXqUbkweMr68Bst8ZoxH7ED2TtkAkGmq8ejPGvTV9S1fdLiEuVqYKnjySUWmiQ6NiK7TX3x4byoZe5wiDoLJqhSFT9G2q97cdZAbA2AGGpCrTAVaiuRZPemeavYq7DqZYRfy3TQBA5fC3RkbXSLRsBqqHTzFKVkvmohtjmFkCH6AvRjgDyweSus2beqN42GqcKitt4h5cwYZFLzG9E6XooxEym4iPoUdCnt87fUTmU7d5rHtN5fJEoJnsWmwEEpL591Q61i2gy5j1sheGPqSv7TgDGxfMXxK2qqazoPgyXFzddZCCpicg2PHBofxxvY9Pp1zyZhdwbto74Aw4NTp6jNytxK2yTrvXiUh81H5h3zG8ojVnh6yqwPUZbRqdu27GVeJPMq2YhLrLT55b7PRiiepfuFGNjNsPu7d6grMRar2H3536kBhURZgvNDKEseb7DPhoRN6fbaUqSF7bC7mHzRKYjEUTZ4oLEGpA5tXuHK4NSZ4QsTK59ZdBMH8J9bVfFdzBx5GiKKobGCVdNDTUepy4UxFHrKuWnaZmoHSF9oULD1qbGS8oqM5wKidzueWFYvDSTZeGwvJ916f9xgDYQEsv52qVQtiJjKZfby7dRJstdPcD3MBTCvhQNvsjA2RXUijUBjdVzYA3S45eLJs1s91AQHrZd88zevMC1922ptPxxwPxhPEvUPtCbZVrCDFGSQNmwkdCryC7ENNgcHEbjuEwsV9YLuuwFXxUs1wQTnKY2ksdN6fqPwmYaN6LoeDvscbCc9qE5YLyRimNp7BubgaPQaEQAv49KAYJ8hXzb22w7AnsMWcbkpRuRnSLkwm6gwNB5Vts5KR9im4GNvUKq3cUu4TdKUx7c7WXVMeUMpVV4RrQ47G5CoTUYVycfQ1mZUECgTdMUsaGh2kFoQczuk7JYTw2RNCx8Eoph58cGUzqbrGPQ1ce4RLy4Ah2DDNqm5BMnefAvWshG2ECL95QE954ywGnJuzykbLfea4xojjmnBhMHDdFdbefL8qo91s7cQsP2Kr8rXscpeTooabFUzjUeVmCG8crYtzTYpyEEubTX5x4mzQTUuJTqZfiNb7AcgWS9ZAac9hBU8CxaiMqZYZHXgxyBf6rSD6qpuuU1TN7DMsGgLjrwmzgH5K87xBRQqtFQriVN75HugasxPzhwt2ML61i3XpZHjDbpMSpV8PjQuVGUTus3E7j1X83wNKXCWGCgj7pyxZMD9PRZqnfXeWCuJr6557Tsj88Zw4kDe36w4SAySDSZcM8oEyR97jmsUtLf\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:31 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"e1-u2PHO7nSNW/Iej7FYCNm+qoLv30\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1769515831099\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 01/27/2026 12:09:31\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 7b56fffb19711ac54f3a9dbe9efca5ac\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VhDP8YWNnRKxtSSKf3t%2BZ6yXzu3%2BdN1NDcvNY7N44bdxxL%2BelQxW0GfQ1Eyxh12JiTXRre%2F2CrDJszdgB8%2FpnTbIezB6v4VTh6zU8VXsM4FbOQ5qCdw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482440f87f120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":225,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7ebe1a37a2ba00c296b3f9384be5972d","sha1":"bb63c73bb9d2356fc87a3ec5602366faaa0bbf7d","sha256":"0db88e4fc7ae084eb4b0700973a34ae96352a966217842612983d608807b45d4","sha512":"b7c8e400017dfca5ef645079147efc9eea422bfca72b0a66255f1267b5f70d256731d790bd81d182081c7bdfc05c519ad3eb0a06f7e674fe76f14db67897ee25","ssdeep":"","tlshash":"37d0977d144ef7840a702007c22b4e7e846b0a79ccb6060403260942a375016614dcc4","first_seen":"2026-01-27T12:09:53.499401Z","last_seen":"2026-01-27T12:09:53.499401Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":337,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/fa-solid-900.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /fa-solid-900.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/9dlxd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 150124\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: \"69784ea8-24a6c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z07vpTHcUP1dZLDECstbuBl1iMsDPwS7YpSReQT6CR9aFXsfRKCKDYT%2BLKOTIp4k53psC%2By4wOfGDyXh1bDbdtxMFZxSmSzQsR1rpuKvdnaDgdQPktE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c4824338fbb120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150124,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 150124, version 772.256","md5":"c64278386c2bbb5e293e11b94ca2f6d1","sha1":"6b99aa650bd12a36caa14e0127435d8f4cd3ba73","sha256":"7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880","sha512":"0ccdc1515510d902c0b4a48b863c48bad86e1f766b1f9c890a64e28d91ee7c6d488241c531fc094d15b29c211da71e092587a987e24ee8e67ef8ea99c284e821","ssdeep":"3072:7sCbk7w0ZXdkN6iMjif3Lr7x7wAtf+D7gDk1feXDLnurWHqrNIuv5n0:7sCbkFZXdC7MaLr9w2mIY1feXXurWyNW","tlshash":"28e3123cf2c6d486735f5aeadb79636894fd0a2e74ecc67d26b982112048f828174d1d","first_seen":"2023-04-09T20:30:06Z","last_seen":"2026-08-18T00:49:30.718463Z","times_seen":45527,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DSNdjqSn9PKw%2F6xAQEHBuwDwSJPExFT2lWZ4BllTM379Z5zJbfB9L28SmFPbwFAx7FkgPcMlP754Byw53Vdbm%2BxFNdKiALcOphh%2B1iwzDf2c0IlAF8k%3D\"}]}\r\ncf-ray: 9c482433c87f120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RdyZGNERQwr2e2WQ1irlrwgqZfQSqyV2m%2BaPvvZIpCaM%2B5LDvWT8AFptOEJa5Y4CMRbtg6xAf7ffh9B3f2s5TbQoyOKNi5KkEaybKNLbB61YkwyhzAQ%3D\"}]}\r\ncf-ray: 9c482433f907120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xyQxJW77wQeITzdMHYbp%2FDl0CYLaThwKXkrshw3bMQpt65JIpj4a20%2FuTBHWrF3Xej6aQHHZNcBRVhT9RnIFdySGOahtzKVgtDfaNMQjQXcUkQBQXk4%3D\"}]}\r\ncf-ray: 9c482433f925120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tgBk2R5OCwwOVj87EbVw9Xv8NAFtGRsIVqUeGbCTElUdOkQLMDQoxp9SRPcEfzFBE65cWhiFh4ZrpYKkO%2FARPSsuNV0aL1U3lWxNwJqpfvJla%2BArjPg%3D\"}]}\r\ncf-ray: 9c4824344a0a120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0iW%2BJz%2Fc1Fvp%2BLA%2BEz9vF4rlGZZG%2F9di%2B3qtecaIzdJ9A5Ldsq4UkhqLAIz6xPPpc44twu6JQQ1Um14bvkr09vorrwUGvaPXk%2BSKpo3FAbxAxyGhgf0%3D\"}]}\r\ncf-ray: 9c4824344a05120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fdayjs.esm.min.js%3Ft%3D29491929%26u%3DyHbvCglwwSMI2ZDpGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGZjZq1_pbqJ1SHc3zpNCg","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Fdayjs.esm.min.js%3Ft%3D29491929%26u%3DyHbvCglwwSMI2ZDpGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGZjZq1_pbqJ1SHc3zpNCg HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:30 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\nvary: Accept-Encoding\r\ncache-control: no-store, must-revalidate, no-cache\r\netag: W/\"9c80a-go5AMoyo/3QPEJDm9j4XDBWSpiw\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=dayjs.esm.min.js\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 01/27/2026 12:09:30\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: 36f2da08d8ac658094c9bf8c05d6e7b9\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f6sbUvI3EADQXuHs6%2BL2WZQafHMVAX9Njj2OJIPLbCNVvEJdVE7AlaV5FZX%2BCwaBvKebXHxlYs8qQyiAJpk9Yn%2FudW9ZcKM0c1%2B4xVcVkZO7edJwJpY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c4824393915120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":641034,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"c835ce0aa761a791b29ba4c102a85e28","sha1":"828e40328ca8ff740f1090e6f63e170c1592a62c","sha256":"4ee6631554867dc1bfadbfe5f4b4ebf4cec5164ba142f8db92f840c2028496cf","sha512":"49cefc3ca9614cebafe201eef12b5cdebcdd19da6ab30f530d7a81a8ef91fca5f02eb63108b8056c2dbd4c22b8b337aae939a712f4a876bdeef21a1e2a9f3225","ssdeep":"6144:9ujB8gltIeTM5/S8g6zRhNgDzQebuazBzqXQPkBAUvVdZcml4L:ihltVM/g6ZszQeqazNqXQcBvK","tlshash":"29d4bcec970a167788cb97b6423363afef884d1a236b3c406ec19cd1574a74e53ea15c","first_seen":"2026-01-01T19:22:06.925398Z","last_seen":"2026-03-30T11:52:16.142566Z","times_seen":405,"resource_available":true,"data":null}},"time_used":849,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":686,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/css2-1.css","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /css2-1.css HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: W/\"69784ea8-22ac\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MbNJBh%2FhtyVTFIOAgi%2FC6ELsDqz94Jj3smWYSbwWrJww54US6I%2FGXy%2BI%2FwJ5i9Yk5WfSygOUq8kd1L1ITgoDGNed6FFMnT7KFN%2F76eUDacMcftnKJZA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482432fe1f120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8876,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"32d1fd2d07f445f23195a2cd483c0a46","sha1":"c0de21743339926a1ce72a9218fb2adbd6ff8340","sha256":"cc5506f8da260c59c421a591a46298de671810d49540a3759866657c4f23401e","sha512":"b70b499c15b205fde524cae8907ff2d80b2f34e412f6ef3d02972b67abd70137cabda9842417b1662f06f93d32fc1a740f807de1f05ac83f8b6d7e812eeac3e9","ssdeep":"192:9TNe7m34MJD7TOdUm3/TJ8eTrUdm3iWJldTE7em3R1JGk:h/P0NNPq7","tlshash":"f802ab91042b5100e7970cd627cf3f366edc2148a049dabc2ffd188aaceadb953a574d","first_seen":"2024-12-13T17:42:20.393767Z","last_seen":"2026-08-14T05:17:33.670112Z","times_seen":755,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3429\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FPCbbuiwyD1hsX7cFV3oi6fkShK6%2BcQ0DpsmhMPousN5ja7Ma4AQ3eoYPHZNGhPOkTj1JLcRAcDhz31gvU3t%2BxjvvC6RV2p1nxD%2Bl2Hevmo2G7I6A4g%3D\"}]}\r\ncf-ray: 9c482433a80d120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Pp9h%2BsBZJgi57DsKwo3DP8zYflq0mQ4rSmAj7OU9QZs632Ogxd4nDjYDPfSIao%2FY%2BC2S7VRxykfZ%2FWfD5OK0jXjh5DEVfas2AEib%2FMbnb4K8UHN5Las%3D\"}]}\r\ncf-ray: 9c4824347a7b120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/secureproxy?e=ping_proxy","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:29.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:29 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hRb%2FvBttNydH3B1w9PRLI4J%2FOrUE1Kb21miSkezIBlSXggLV%2FXUWszI8iJlLZHKqNQ5kAXRPxX8vo6P1IcmpQzdvEompRsgqDVfPCiKbit2kYDeky2Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c4824376bb6120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-08-17T16:47:50.33609Z","times_seen":9046,"resource_available":true,"data":null}},"time_used":278,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-27T12:09:28.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 12:04:03 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2e9rB08KtjcbBYTp3A%2BhvTeuGARcznqxBYMApys14qgrbme2Uyj7Tf6WQSMV6JVdRjUmobUUAZU3XnDJoNe%2FdrvNzhjWXGfjyHEYbpFnqr3E%2FQ2A\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c4824302ca6b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45196,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"03a068f747d50081c9f06be3f3e7755d","sha1":"97abdec585e46bfd70f413898b9a56525dfedcec","sha256":"c90deaaca55dbf6b687281a436f038c27c775c1ede629b3d908a6395a85bf4cf","sha512":"238c7db72d85145303e8c158499682d5101c73d81a442f69db077fbf66532c7835c770cd2460f97dc8264fcaeca6415b0008092459a92cb46ff8d21e62b9a54f","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPx:dCzOLBKZJ/ow6AvzoCokY","tlshash":"75133160f450283b351ba1ef2ac28f6d75baa452c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T12:09:53.504694Z","last_seen":"2026-01-28T19:43:54.418437Z","times_seen":8,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":27,"dns":10,"connect":1,"send":0,"wait":268,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/css2.css","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: W/\"69784ea8-1833\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AYaxtcOlvjtOxvYeIoflK1QqQnj8qtSZh8hi2QrnWg%2B95n2wCIrN%2FeCbvyWra2dDgg%2FfpFyE5eYwEbzitW3llPlUdNe2XlEp2d5ZATjuUSeNySlTj0A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482432fe14120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6195,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"091a432ce5732c51a183d557901b2425","sha1":"59f1739cbdc6040616f9e4eb170b9bbd3e133d3a","sha256":"2932a0893c6528b13291ff909d3a5b368013a206e3b519e9471c8e104a4ddd20","sha512":"96bd8044dff1a0abcb0c02fe30fe5ae41128ad3e382c8a22cf844d8d38a88081c2ff4114c439d5a6becd2af49c9a4fd679e78a46c63b643fc3274ea403508f97","ssdeep":"192:fTPUZm3KuJxZTk/mm3thJ+UTpm/m3o8J3k:rxDOZjc","tlshash":"56d19d91042f500063971cd663ce3f365edd6148a049da783ffd1c9aaceadba53a174d","first_seen":"2026-01-27T11:12:46.13403Z","last_seen":"2026-02-14T07:55:45.651285Z","times_seen":16,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/9dlxd.css","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /9dlxd.css HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: W/\"69784ea8-18c3a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s18JAgGlGoKskKHo1WtzohDufh5IFgqSb%2BIaenO4vuHuX8OG8J0L0iyeYe2EgaKvFP%2FNRNUYOA1fGrVGFXd8vpNoEBJt%2F5%2BJHcTxMgd05z4RLSCu8uU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482432fe18120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":101434,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (41066)","md5":"77edadcee2aadfb1c573c6849e6b6f4b","sha1":"1781c815f6fd6dfc75312cfb2e99709fcffccc3c","sha256":"dd61f2d3bf2b0a2b6f31242ec61888313fa8dced5eed31e9c67e243bbbf08ff9","sha512":"6af29a86d492ab85e8945bee153b9340698ea27738f8aea5e739c970ec579813452f119599e4a86c96be3ba31ee810b02aa55010915eabb752975cdcd2a140cb","ssdeep":"1536:PMCMPMCMjMCM4MCMwMCM3sVMX70vebPMKXSFPTytGuCprfZC8:q70vedCFbytGuCpfZC8","tlshash":"cfa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2026-01-27T11:12:46.140606Z","last_seen":"2026-02-14T07:55:45.654268Z","times_seen":16,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/bafkreifesrdorgmwpy2zfrnzvqb5guc7petxirvf2v2vaxqntytmrwyyw4.png","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.804Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /bafkreifesrdorgmwpy2zfrnzvqb5guc7petxirvf2v2vaxqntytmrwyyw4.png HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 5394\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\netag: \"69784ea8-1512\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0FnLPnRGrzEfz1UzHMraCuCcvIpuX0GoICvcB4DIzJjksFcbzlojU8BflQChOrcZcnfCZbNo8eTaJuvhAHAAty020oseiCS0THctRjEQOjkzW2SUhMI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c482432fe2c120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5394,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 401x402, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"eef71258de7a12a58e89d1c68ef2e51f","sha1":"9e85a5060491bb5b0fbf1a9aaef60dab9db26e95","sha256":"f072f55ffb215073c0978c77ed3be187fec4a05c6c0e60b8ff93af31038a2518","sha512":"1285a7ae2bf1b1a461930421a28bbde59f5870ce8eb56024d42af3b3cbd8200f2483c63a1c94162209b4fdf53f58dc7a4fbe83dcb9d3a69fb7366aa5005615d0","ssdeep":"96:bc9zQiAcqa5i9427nNZAtmWdFPFcjUI2uwOpT44H6jJ10khmd4nZAhwusX0+b:46b/f9xYtmWbFc/2IT49jztHb","tlshash":"b8b18d070997883a3c8b36afdd7006644304896f9e385bddf466c732862da53062ed9f","first_seen":"2026-01-27T11:12:46.141967Z","last_seen":"2026-02-14T07:55:45.650171Z","times_seen":18,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3429\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e0zvb1Hc1nR6MnR16W%2F9sg8YMf75wGPC7%2BNIC4TNZKbU6Pi90QyIr5tD4%2BYK9IlWOG4TdQJuXtwOqS%2BVXk7f%2BE7DeF5iFmUs2KNeE1xdQBgU%2BEuI6AE%3D\"}]}\r\ncf-ray: 9c482433a818120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jUNJyfeOjOwZIQqfaN0M11XuZkxycXuHTJs%2FuN3yNvbAJLADxFUQnU%2Bf91UGTjhoQpYMFyOHD51nXI7fCI8rnq7dxRzgEvl3Qa3e%2FO%2F89SYsARdA5II%3D\"}]}\r\ncf-ray: 9c482433e8e5120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"airdrop.moonbirdes.xyz/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"airdrop.moonbirdes.xyz","domain":"moonbirdes.xyz","tld":"xyz"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://airdrop.moonbirdes.xyz/","date":"2026-01-27T12:09:28.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbirdes.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 15:42:26 GMT","end":"Sun, 26 Apr 2026 16:41:05 GMT"},"fingerprint":{"sha1":"04:D7:39:C7:D4:D7:5B:BC:8B:21:97:44:7C:B9:72:C8:C7:9D:26:75","sha256":"E0:F1:B7:FC:BB:AE:88:FD:4C:CF:EA:71:50:CA:EE:B1:72:6E:43:26:4C:8B:5B:20:32:DF:CA:2C:7C:74:B8:C3"}}},"request":{"raw":"GET /UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: airdrop.moonbirdes.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://airdrop.moonbirdes.xyz/css2-1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 27 Jan 2026 12:09:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 05:35:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 3430\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VaLHn6UQZrfDhBiUmzsvf7LaRC6nLYeITNTbiOBazkIeJ5HnHGMgPXGXOjKIyTQHe8BJh7eReJ0pjVKBELBY1qgEocc89Hiv%2Fdx3R%2BEgah5%2FUnCLnhI%3D\"}]}\r\ncf-ray: 9c482433f918120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45070,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20650)","md5":"6edb76fef9a99f5f357b41790647d003","sha1":"a478ff961854a254c0037932d8978f2b561f0dcd","sha256":"ca1731d19eafdce264c9d0316c32715ba73e986309713b896d3eed6f0fb18131","sha512":"605b080178b80c16f86084772e6c123f8c13881a0fa934e9990b51acbc4e641ed84e8ca3da03780638a6cd245ac2d4d5eea2cea5caedb0cf907571f01d8236a5","ssdeep":"768:o+Fd767hPgNPrmzQH2L0r82It4uSRhKut5NFgl+FU+xHyvfSDIJPJWf3b8fzwZPk:dCzOLBKZJ/ow6AvzoC8kh","tlshash":"fe132060f450283b351ba1ef2ac28f6c75baa456c827661873fc81c2dfd5ef69d63814","first_seen":"2026-01-27T11:12:46.125539Z","last_seen":"2026-01-27T12:09:53.492716Z","times_seen":2,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-27","alert":"Sinkholed","trigger":"airdrop.moonbirdes.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}