{"report_id":"9164fb03-64f1-4595-b102-aab5304a54ef","version":6,"status":"done","tags":[],"date":"2026-02-14T07:51:56Z","url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"172.67.137.61","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"title":"Moltbot — Personal AI Assistant","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T15:07:13.570573Z","times_seen":17763367,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"172.67.137.61","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-21T07:51:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"moitbot.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"moitbot.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"moitbot.com","ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-27","domain_rank":0,"first_seen":"2026-02-12T21:05:29.186772Z","last_seen":"2026-02-12T21:05:29.186772Z","alert_count":12,"request_count":11,"received_data":4267139,"sent_data":4830,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.molt.bot","ip":{"addr":"172.67.165.116","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-27T08:49:52.986482Z","last_seen":"2026-02-12T21:05:59.740305Z","alert_count":0,"request_count":1,"received_data":6455,"sent_data":438,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"openclaw.ai","ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-30T05:34:56.583129Z","last_seen":"2026-02-13T16:06:01.735282Z","alert_count":0,"request_count":1,"received_data":6443,"sent_data":437,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"f278e1582a6b32d6a9a05328bba73b0f","sha1":"02780b645a044990e49787663d3dba06626b1e3d","sha256":"07317dc90130ec69ed8e07a8362168074f9067473354101f361449cff37110aa","sha512":"08463b63ba1654bf203117d8f0c0a2ce4b5d92914ffba7c8ac3d942ff1a812c86cc61d9e840e5f3422c2b22d1b71b1a06b9a6d40d4e4259b32fd8cd40cc8357f","ssdeep":"","tlshash":"55319948a43216904242e8f1c676abeeabe774080574446d349cbec7eff8447e521678","size":1529,"data":"","first_seen":"2025-08-01T04:16:24.221852Z","last_seen":"2026-08-05T07:20:00.230465Z","times_seen":3443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2380d391cf784bce2f77e0e16fa2268b","sha1":"2b88cb08e3d7f56772d46fe1a10d84774e8728d5","sha256":"e65fcff70fe965f3d1878fe515a7ebcd265dfe61b15461521450c882e8d081d7","sha512":"0f3264af3a045928be20d2ee1ef3af905571d07e3fc25eaeda22199baca89b8c9bff94d90d81124ff45b16c5e40df291c2f49d9464ba901d2d961f6fd1196f1f","ssdeep":"","tlshash":"e6411b1e00aa0aa31ba3054333ce846d0956c2cedcc73534d3b27f8134c67832a93bea","size":2254,"data":"","first_seen":"2025-08-01T04:17:54.882582Z","last_seen":"2026-08-05T23:53:54.837406Z","times_seen":3265,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"0e1ee9f442371606d9a13b41a0dbeaff","sha1":"a05c25c8ad9127fe7d45319ce13e8b4a485d2e01","sha256":"713285cbc0cb910dfd2e7a86c604d191a27789ae50964ab1c674507ff4a20c45","sha512":"1dbac9fa1e0b338e780a3600f1a3da140a6c83a961a1d0c6c80fe3dc5a9041c346c471d264a07ccc87457cdccc2a28b768d02283512ba9cee0fc2e2b7124e42d","ssdeep":"","tlshash":"0221fedeb2826488526794d742cd8dceb8e617a919008c20452ef299225c3e8fb6ad54","size":1177,"data":"","first_seen":"2025-08-01T04:16:24.218288Z","last_seen":"2026-08-05T07:20:00.227598Z","times_seen":3335,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"e7cedee5f4aabfe0f0a25596641b0073","sha1":"9e90df4076abbd3350295826c5ad3ec1856ffd56","sha256":"c2e60dc68f09c70895f8cb98a4a88e16cf3c691d5a96b9c93c3aab931eafc258","sha512":"17dc0e86fcd7af709d5ffb50d255169d2300566d30c2da4345505703e6a6ebf303df263db9561688753bc03af86b134ccfa9f763966f8612ef554be796d6c025","ssdeep":"1536:jQe6pw4biVcuVXdWAgB1PusH2DY7sX3lX56oH:Me6KBVcuVtWAgR2Do2X6oH","tlshash":"7fa340d59a4bd0e08e5a11edd077ed0ae0281aa3cdacf193b92cded1355df22c84753a","size":104467,"data":"","first_seen":"2026-01-07T13:23:26.460119Z","last_seen":"2026-02-14T09:07:38.76649Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"moitbot.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/orion.js","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","size":107989,"data":"","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"moitbot.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1e21743cd2ee2004cd56bfc5c29e3609","sha1":"bf516634ffbcfd3186b71dafc0ecdcc47894c439","sha256":"0e428980439e794b176e0ee3cd84e4878510b1d52c1efc1c00f4af9729a17029","sha512":"4264e5ce5b4f3acb24046582388132a5915398c9266c18c6349d75fb94bd74bac990dc6ebd12e1e118a3a24752a3e4badae2faabd69b9827d1f223a0750da4c2","ssdeep":"48:atoyTqSsM+c69M+c69M+c69M+c60778KK7NaaM//M+A:atlDNDNDNDl778KKw//M+A","tlshash":"25913f32165427da63ce8fd45a85751d01d2c89a383e60bdff3279eded3a683c031612","size":4506,"data":"","first_seen":"2025-08-01T04:16:24.215618Z","last_seen":"2026-08-05T23:53:54.843805Z","times_seen":3395,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/670f7257-db75-4771-a9e1-3c0debac38d7","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3acbcf38c1e4506bda014f97ad6ba7ce","sha1":"a3bc5590640a3de4a3708ae5317875a11fbf390e","sha256":"b32f814cd193f11362d980752a713a26e82a567102934bd11a8cebc98dcfa0ac","sha512":"19b20d5babfefad0d6305cf214f44c637035d805782cf888f31741f41d3e36baf5e82fa2123306fd0e1fab4f47c8f25b85c88b7862193d968c571dccacf93b4f","ssdeep":"49152:x8pMOTgn1fpj8j0mUZDXAlU9TyB3tYpeil5ee68wW2QUSvhjG+EyY4bfO3xrQank:MgZpsZyDX6U9TydOobO","tlshash":"b50623c1ac47a0f08f50812471e79d1a506d1827b9def1faa648f9c1346ffe1c2ead69","size":3673053,"data":"","first_seen":"2026-02-14T07:52:00.593146Z","last_seen":"2026-02-14T07:52:00.593146Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"59a13eef9e5e0ec7844e58e8b47d54a0","sha1":"0fb2b2059a878b87f8524284d448dd46a4351953","sha256":"c890c150b008d069bfddb86ee2c2e3fe979515939053b4c53fd6853b68e4fe35","sha512":"7fcdb614d30b1141e9a1e134a98e2888007f786f866c24e6383106d3e003f094e72901aa295e7d3450fccf5a249b25b436401a5b9439205da6b0eec8d72cfc80","ssdeep":"","tlshash":"33f0beaf336126ca23ae6ad20796c01d1e72e4ab3002163c575a36ca0cb6f52521b07e","size":494,"data":"","first_seen":"2025-08-01T04:17:54.874483Z","last_seen":"2026-08-05T23:53:54.838461Z","times_seen":3227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"3433c9d3e9b7e8e5b34ed72e309db572","sha1":"d53d7df082088749c1df6b08330ee9b9e4076932","sha256":"1d96fa9904e3743570bccd5be90e83fd91975299f374093cc6f723673d582dd1","sha512":"ffd0e047331871f21738643968b7eb7fa045ee0e45346a9ea986c4b8a3e745dd310542c6b2734f6d244408bba6548ec66f5cd7662c69485b5e59e3b9432cdff2","ssdeep":"","tlshash":"06f04245bd825a24d35670ddc41f978cc53690dd91491c4cbb64ece1de94c2cdfc6534","size":585,"data":"","first_seen":"2025-08-01T04:16:24.219641Z","last_seen":"2026-08-05T23:53:54.842182Z","times_seen":3480,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"8de04e3dc63af7585af0e827672eb149","sha1":"02ee5e4b4e73e430d629744c4b7a3e38c36ed06d","sha256":"123e2a4c9c65ad62ea2b0992b1f80073e18a341a810f9ba40d1c4cdc31f1e759","sha512":"a42fcbfd4fc45305b75c0093524abafcf73f7d10f3bbe8cf573f3ea87803f672ae7fd293a116e7c24aeb0ef9fb24b9ea32e48200a56243187d5b550407631184","ssdeep":"","tlshash":"a911cce0aa6c599781c2095034894b02b13cb020203d9fd0bf75f0ce7c7c7ec96d262a","size":1000,"data":"","first_seen":"2025-12-20T20:03:49.143914Z","last_seen":"2026-06-07T00:08:21.702938Z","times_seen":1701,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"94e89a3556e15e2bef65b74e0b763f53","sha1":"21dcf9b6bf2f2d25c8ad72464e0b5d976632ed6f","sha256":"14fd632efaea9277695863778c59f41353c9892c07dfa22a98849d71d81b5832","sha512":"3dadb052cd223ff5e8c0e240a2ab7bc153248f0a1936ca767b9bcbbafbc60dcf4e26c197a2ecacec73575fc0671c40430bd0728221d5cbec56214401cd0cade9","ssdeep":"49152:ycpkGzoXlBcrs+kJb/ItajQPloJGbmVxmmiSwW2QUSvhjG+EyY4bfO3xrQanJfCj:toA5Cb/6ajoOYb8","tlshash":"d70633852c47a5b48f844221b1eb9d1b516d1c23a99de1dae64cf5c2343ffe182ebc2d","size":3655943,"data":"","first_seen":"2026-02-14T07:52:00.598525Z","last_seen":"2026-02-14T08:22:12.896986Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"moitbot.com/index.CcT2Xj7B.css","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:31.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /index.CcT2Xj7B.css HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:31 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\netag: W/\"69793a8b-5cec\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ze5S1dmm8FkSC7sGQ03gRBAQlQARTkD55TLph%2F4ECKpWyEBgYf19Zj0egoy9pwfS3XNGSbic3D2ZaRSsANRkoT7ZUsgRGqiBsS6j\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdafb1699520883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23788,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (23787)","md5":"fd8be35bc5bce433b031604ea334c7ec","sha1":"ab571f249dd5f0e627ef50b328e2e9fd89cbeadd","sha256":"af8952b7d8f2b09d4fa09c38f2e2cb55da1b5049e6c6f88e19a3fd6c980836a2","sha512":"41b20e80565c24558d302808520c4e72bd22163921d382810e84de34ee2e8e0f9c400b568228a7bb540a669e0674cdbf2702d33dac9e55633bb28935c684e702","ssdeep":"192:bxAgGooNVdwPlM7AYQuUMf8uGlkNjZ2MA+sAMUcFwna1YcpF0MI86YyyUx2+BUdE:+dw4AMNJA+Cdh1ZpF0n8EBxRBONBF6Fh","tlshash":"0cb2df51731c5829e037b86be2cca1781214b602c63387dcb95f6feda5c63e2a9b154f","first_seen":"2026-02-12T21:05:34.327468Z","last_seen":"2026-02-14T09:07:38.757766Z","times_seen":4,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/jonahships_.jpg","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /jonahships_.jpg HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 21074\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\netag: \"69793a8b-5252\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dk5HX5XC3WoPUmToBGdyUfEn8u5mXp5zw0RTaJxLrfsj3xkmCJSrZP1OPVkXZ%2FTTJIMej9Y8DSLUF4NW%2BnWnK5I7gdvhKN9V8v91\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1a8a760883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21074,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"af448e9be3f0fdea105d8ed41bfce705","sha1":"c4fa452b86785ee3e1ab10b5ce395d9690933cdc","sha256":"979f49866b67a42f32d9de3c95194c434ac865992ec2dae641534ce01be694b0","sha512":"0d95c9cf7c433f0076c3717ba0fa759c6c5b2115628ffb1fb2477481b672e21ea8ca06386ff60710d6dff5bbba8f99eecfb7bea5ac5cf93168ab28e754c49899","ssdeep":"384:s1ZMrgadIdKNSLs+qHptSimsypaY72qFyZCgl8Bouisy:Ck9KfLoHpwFsUfUCg6oRsy","tlshash":"2992d1ac13068715e47e53fa114f8b6f96b67011a18ccde2254a18c27bde6e22fb21d3","first_seen":"2026-01-28T14:03:52.352632Z","last_seen":"2026-02-14T09:07:38.759Z","times_seen":22,"resource_available":false,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":235,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/Senator_NFTs.jpg","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /Senator_NFTs.jpg HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 24215\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:02 GMT\r\netag: \"69793a8a-5e97\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6vRahisAarDar3DwrqbS3HNEamd5sb0ygedrxegIFHhqIIPF0yzfAzIfZhzJ%2FdFdnrx1XjH0jgQqZrEFjGRWjAn5S%2FhnE0VHlDaz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1a9a790883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24215,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"a53f7a14847e5e0bfeb3d72285aef827","sha1":"84174f93c4ba9967f902db4de3225e54f084f17b","sha256":"f700b263f16e19e09d7bf15aa2bdddc4da8e1ce068d7d28694eb9ed056cc516c","sha512":"efe013fe79cc9ba6530b6cfc0432f88d5e342673cad2a5b22a183cc2b96c369ab0b6331d8a7b602ec8a347f5aca950b00254613654d90979f3b2a889f643ae79","ssdeep":"384:sokejYR1EsXJ3VJ9J8JVxsOcEW+60RvlhJymVGHiZlaJEgOK1+szo3gUUOWgLkq+:FkejYjE6lRUFcEZlPnhZl3XlUOtLkqXu","tlshash":"acb2df763fe49103d61c7ebce1258d3e49aaad384ce6d63f8a02423467274d1697e09f","first_seen":"2026-01-28T14:03:52.32376Z","last_seen":"2026-02-14T09:07:38.762316Z","times_seen":22,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/oneishaansharma.jpg","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /oneishaansharma.jpg HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 27944\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:02 GMT\r\netag: \"69793a8a-6d28\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=opJgGRRHn7KrEJRwq2Vn97yA5ST%2FswClnhtsYc%2BbGAwJN%2FgolzNi5vJcohkuBuWl41R6kfTO74wsMHFXfvfj4iKzQVG7AUAqQlUL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1a9a7f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27944,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"848ff096bcf232915a55dee9959443f6","sha1":"003aa7300d8d1b0ca2c8f208e2b2230271112df4","sha256":"85da40c33f07eaa0b6db9b130f92175d5bd7f54b5f8010adbe5c9682af053915","sha512":"b94aea6e0c9d1230a13d6912a84734e77426889c2034d61d79897eaf548bd9b06afb116e279ae7bfa590087f3e4267ee137cbf0cdf049d5ef4abeb659059574a","ssdeep":"384:sBAS1tNyYBQy3k9KH3ZfzuGDfXzXljNu9KEU0rtqHeI1cNZrOndEvToLzn5A3cCu:0vMYBQEguJa6XzXRMtRIWTnvKnkc9","tlshash":"52c2d1b4cf7e462af74d82b501e18592c62d8d767c088a6bc8d12c6dbb1e2d1d25b184","first_seen":"2026-01-28T14:03:52.366699Z","last_seen":"2026-05-18T05:33:57.413516Z","times_seen":39,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/mneves75.jpg","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /mneves75.jpg HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 49051\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:02 GMT\r\netag: \"69793a8a-bf9b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aGT4BENof2QZhFdDml4xrRX6t%2BMGjViwNacebPeU49gSh93mbIjTV5Oyk1mzVN0MZil6%2B%2FwXL6m60wDcrKP0zHs8JRDRO9khzhAW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1a9a7b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49051,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"18f2c2e878ec39a0ac3b1e0f9bf82d30","sha1":"47f5d045c0e1bad785c603f6636881320e9fa47d","sha256":"718dc6aae23b73497944034f8de8d015b27b6d3120400cf9645ff4fbd95e178e","sha512":"44d6ec1e2ca118577a82447747720b2b4f8208a94c327736a41d7f2040e3fd6248b0a957b611caae14c7ed3acb07a46f182e90a3a657e4504c3b73d211aab9fc","ssdeep":"768:C19zypeo5XvCXfFKluBZJQThdQxNMkkzyezCVIzq463imI3EUcAxakgffUpU/2S4:C/7vclEjQThdQxNIzCV27yiYXkKfsWn+","tlshash":"d923f1836b1c6d64e2ac1b7d51d276b1fb050e8ac72603c551e184a0fbf9650bec4bbb","first_seen":"2026-01-28T14:03:52.364087Z","last_seen":"2026-05-18T05:33:57.404149Z","times_seen":39,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/secureproxy?e=jscdn/getFile","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://moitbot.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://moitbot.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eo2upuit3j1bi7kc0oxl\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8dAWx2t%2B3lLRx%2BDMbE7dug%2FMrvR8g%2B5LbVpG44w%2FrmNt5ldg7cQygQ%2FGYRj%2BYEHwmC7HCzAOxMn0guBaZpftcvRXgryWYE%2FyMduURc%2BjUkNAbQ%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1aba830883-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3673053,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5b98793765a220348c7b53f0be26808b","sha1":"f489c44950f6c4b6b3453e864fa14c9e82e17247","sha256":"2557758495e3ef12a0f46bb73088e85b274059c8f920c2b1ecb0ad4e3f9b6c9a","sha512":"82b98f6caa860f75b0520056cf25783705923a85724878343d279102deda98600c2177c8a1af157777d5eddc87d3fd9fa4a9d36967b95657e06af09cc41cb6ed","ssdeep":"24576:x8pMOTgnKBUT+ubpi68jt+LaLQZDlZXh6lMX9T61nB3tFaTFei:x8pMOTgn1fpj8j0mUZDXAlU9TyB3tYpR","tlshash":"812523e4e0c190e43f64de3857e76aac907ab06fb9d666790908594029375e3c7ecce3","first_seen":"2026-02-14T07:52:00.577609Z","last_seen":"2026-02-14T09:07:38.76019Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1063,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":356,"receive":707,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/css.css","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:31.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /css.css HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:31 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\netag: W/\"69793a8b-4f9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WjxgefjlnmQ%2BFtGIy1htT3BPKMW1PuGmOoQWabEveEkNIfj0Y6KxyVLmK1aXP%2FND6Coz1LsQ3oOP5FxbHKhOsI2k8AMVECa89FuE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdafb1699510883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1273,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f36b5c9ce62f86dafb80b20e73aa914e","sha1":"2c54e886da040ff77b9f97f391d57ed9cadb62d8","sha256":"aa415a134960a1a48d85cb93c61530b80d233c1c71a6b874e61eb0349f6e4843","sha512":"d71f2e0f3da0095da9763d164c162211b9c1b7de3ea1423351d0631624e84d66230b8973951ecb7fa7ff5e3c16f7fd80150e4a181067062da6b5d53b0d06ea4e","ssdeep":"","tlshash":"d4217fa04459e412e4123c6c33dfbf5a1d4db4261446ad6e3a7d58589fafe6883d0f1c","first_seen":"2026-02-12T21:05:34.324518Z","last_seen":"2026-02-14T09:07:38.756697Z","times_seen":4,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.molt.bot/apple-touch-icon.png","fqdn":"www.molt.bot","domain":"molt.bot","tld":"bot"},"ip":{"addr":"172.67.165.116","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"molt.bot","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 06:49:51 GMT","end":"Mon, 27 Apr 2026 07:47:19 GMT"},"fingerprint":{"sha1":"40:95:4F:0D:B9:94:3E:87:9B:3D:A4:57:25:0D:82:B2:E7:80:49:A9","sha256":"99:49:5A:BB:CD:1E:12:70:4F:6D:E6:8C:B9:09:3E:D4:3E:C1:1E:0C:15:08:F7:1D:E6:2E:CF:FE:81:E7:FC:B9"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: www.molt.bot\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-length: 0\r\nlocation: https://openclaw.ai/apple-touch-icon.png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KNkbtCuf0ficSAaj6rdZyG64pvsqMWrxgYcOFhngw7d8LUaQQPC1GmNhSJp0Bw8X8zKLc%2BKFIMiILF0kV85ygzCTYx0kd2Xe9U%2FxgQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9cdafb1adcfe783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5920,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-07T15:07:13.570573Z","times_seen":17763367,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":37,"connect":1,"send":0,"wait":6,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/favicon.svg","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=6,i=?0\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"69793a8b-4aa\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0VRnoc0gE6rqaxTsgkUhquV9sIydDhVV5eZitNRa%2F2qFMqz1TxtWF9epHYIpGN%2FLeYJaEk8qo8SN084vEWGN%2Bf7VKZ7U4B1Ugbv4\"}]}\r\ncf-ray: 9cdafb1a7a740883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1194,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75661cbf8fd50009be0c46a9ca8b3180","sha1":"fce678ff3189a8ab7c74a896a7bf3d2f22f7f50a","sha256":"fa7e2ec07ebfa696bcc8c27d7e36425cbb7b1772f6f7f04ce390cf5f1c35cf0e","sha512":"e834ca2f4fe1a1a65fd83a4f3e3d1fe0948cfb2547d8eb66b6a56a755ae268964d0d6c1cdc1ff11d73f515dffd8d6effac02e300b6128ce91d341b89d9921103","ssdeep":"","tlshash":"6b21cb64c85d0817e466c365cf0b743a503fc4c25346a3983c6e0eb432b28a7ef1bae0","first_seen":"2026-01-28T14:03:52.326081Z","last_seen":"2026-08-06T06:59:09.980986Z","times_seen":183,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/AryehDubois.png","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /AryehDubois.png HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 99246\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\netag: \"69793a8b-183ae\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rIsZ0gKN0%2FL8SKItt5k83dNGIKL8B55Ib73gCNkbgpnc3E6oNtnHox63sEaPudWV4i8XjZq6BP%2F91OT1D9JCtTofHc7%2F115utxVw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cdafb1a8a770883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":99246,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"43faed82be99bdd9b2108a56619d218f","sha1":"daf1971e20bab257f0b2d73a7ddf4958f3e89042","sha256":"ce257f40c1bede8fdc7f339a76a9aeae40ef9060cfb0609ca0e029b12d35e39d","sha512":"aba2e79ab945efb0f6ad527861cb6021b5fd51e63230482a80d057063aeb9c9aba9638728282024b87c8d2cd9bc8f14692cad71d46a342bcfc4ef1342bcd40aa","ssdeep":"3072:+dibqm4edI1AMeqC7iQqNnuL/pjlzqo0IzsuLm:+difdI1ApzYu7RlzqofoAm","tlshash":"ffa302ec382ada82dfdfa0185a1c521941a7c83fd755bcd2cd4d1f2348a942cbab35b5","first_seen":"2026-02-11T17:04:54.640187Z","last_seen":"2026-02-14T09:07:38.761722Z","times_seen":7,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":110,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"openclaw.ai/apple-touch-icon.png","fqdn":"openclaw.ai","domain":"openclaw.ai","tld":"ai"},"ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:32.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"openclaw.ai","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 29 Jan 2026 14:01:38 GMT","end":"Wed, 29 Apr 2026 14:01:37 GMT"},"fingerprint":{"sha1":"BE:72:DF:CD:5F:B3:BF:4A:21:B1:08:53:B8:5F:F8:39:41:38:7A:AD","sha256":"A7:B6:70:46:2A:D2:9E:89:97:D9:46:C3:AA:8D:22:EA:96:14:B9:FE:3E:20:29:E4:1F:B5:83:D9:98:73:CA:E0"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: openclaw.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://moitbot.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 51283\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"apple-touch-icon.png\"\r\ncontent-type: image/png\r\ndate: Sat, 14 Feb 2026 07:51:32 GMT\r\netag: \"5c40cae81626052fb1285bb4f48a7983\"\r\nlast-modified: Fri, 13 Feb 2026 17:26:44 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::t5wt5-1771055492770-8c916a3446e5\r\ncontent-length: 5920\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5920,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5c40cae81626052fb1285bb4f48a7983","sha1":"b43df556a1d2ef02cb4dc913cdce97d31f661e54","sha256":"e8c7ce0a3a6c52bd904cc55e31a5b3a8b6392dcd70ba9e220ecf0ef1d6bd8c16","sha512":"0a599d0863af0db99a8d4f3600128b9a8668b0701e6df438389eff3a68d26863ff6a9e2a31b3847bb89bedd780818b6bd227a874f196df90c7c42f590a02a0e1","ssdeep":"96:44BYD6fiqNHEpitRig2uf10oQ+v9B+xnAh0l1KTEQvzZ/swPh9i6JGp7DH966AUl:w+fiqNkpqRiaQgBCcGKTHLOyu7Dd6rw","tlshash":"bec17d721e02b565941a2ab27459a66ad1426fd30c118f27adb2ea360ec2ab40c5f616","first_seen":"2026-01-28T14:03:52.328096Z","last_seen":"2026-08-06T06:59:09.982457Z","times_seen":123,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":16,"connect":1,"send":0,"wait":15,"receive":1,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-14T07:51:31.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 14 Feb 2026 07:51:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k0YPZcZiqoxOvW4Au9%2BYLeyJhtHUdr75TWQ%2FfdrrBJ5Kio1ysVAJb%2BgnsnkR24jLCrjWfesY2k4Wop5YYrfiYRF7V%2FkcTvmrUBJr\"}]}\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cdafb13ffb5c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":228202,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5913)","md5":"67c2baac513ba94e513412c68887141a","sha1":"7026e47fc9ed598494f78e8f2187f4ad7d108f0f","sha256":"07165ae7982b1acbabb0b36103e8c076936d0224634f134dc4a6197f45d5965e","sha512":"dadfb16ff4eecc355acbbbaa25355903ebe761ffddcca709cd72eb0c951a10e2dfead381afe1f2f4ca19c1cfbb2b99935dd49c1d799310f1c74797d6300686fb","ssdeep":"3072:BjYLlxOYLlxFT7oT7CveoiNBwbCnUm4zgu4vo+yXPMFOesb1jCFUnYyJbXIawLwc:BsZtZjQLoiNBwbCnUm4zgu4vo+F","tlshash":"7824fe2913a504ab8163b0e6c1a9f234a742e64fce114ac9399d6ff99f59f74f83304d","first_seen":"2026-02-12T21:05:34.321107Z","last_seen":"2026-02-14T07:52:00.584935Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":28,"dns":10,"connect":3,"send":0,"wait":267,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moitbot.com/orion.js","fqdn":"moitbot.com","domain":"moitbot.com","tld":"com"},"ip":{"addr":"104.21.86.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moitbot.com/","date":"2026-02-14T07:51:31.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moitbot.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 21:25:16 GMT","end":"Mon, 27 Apr 2026 22:24:04 GMT"},"fingerprint":{"sha1":"61:F0:40:60:32:96:A8:0F:BE:94:BD:16:C2:2E:20:09:06:B4:6F:FB","sha256":"5E:D2:59:FE:6B:B5:E0:03:10:E7:6A:C4:C5:8C:F6:9F:61:2C:B3:DD:F3:6F:0A:9A:90:AA:79:E2:50:80:76:9D"}}},"request":{"raw":"GET /orion.js HTTP/1.1\r\nHost: moitbot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moitbot.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 14 Feb 2026 07:51:31 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Tue, 27 Jan 2026 22:22:03 GMT\r\netag: W/\"69793a8b-1a5d5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FDGmL8tTRUs%2B%2B2afQPzwM20XSaYQx%2FFrqgeeRqV24PVO4HuHIAeMSR5I5%2BOWDt72RShbHwVX2U13Rn3UVO9W%2FrnIevnhuG3lBQPu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cdafb1699530883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":107989,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"resource_available":true,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-02-14","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"moitbot.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-14","alert":"Sinkholed","trigger":"moitbot.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}