{"report_id":"ae310045-98c4-4cd8-a769-e048cedea38c","version":6,"status":"done","tags":[],"date":"2026-03-04T19:03:23Z","url":{"schema":"https","addr":"claim-moonbirds.live","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"claim-moonbirds.live/","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"title":"Birb TGE","dom":{"size":19863,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (698)","md5":"f7cf9af7c5f0ff52e8b7f2c61b8eb509","sha1":"9f99958f4f3685d772868a0dc711d401713b996c","sha256":"92abbb9481e74a777cd307bd3166d2ff74cfab803c03c70190493f5e5bf3c7a5","sha512":"030d120826368819e34480b35a95e81f429bc283b47299c94227e01f05685acc4638f5cd1f4ce208c48068ae02eb913c4ce356824d5f7386050fb54ecadeba00","ssdeep":"384:CsemviMZDKlylF7M89uFkyLZ7ff83qP3rwg:deiZuyX779uFkKZ7ff86Pl","tlshash":"9e92b5284ae201379467e1bdafe6e8063930c403d90bde1d7adc62529f8cce5c9f6759","dom_hash":"domhashcc4e3d2d09784bfd9f7b2586b6140883","first_seen":"2026-03-04T19:03:33.138362Z","last_seen":"2026-03-04T19:03:33.138362Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"claim-moonbirds.live","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T19:03:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"claim-moonbirds.live","ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-04T19:03:24.609453Z","last_seen":"2026-03-04T19:03:24.609453Z","alert_count":36,"request_count":12,"received_data":1103614,"sent_data":5748,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"claim.moonbirds.com","ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2002-03-22","domain_rank":0,"first_seen":"2026-01-30T04:23:47.957524Z","last_seen":"2026-01-30T04:23:47.957524Z","alert_count":0,"request_count":1,"received_data":85055,"sent_data":458,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"claim-moonbirds.live/","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"86f9969f9cec561e5dbc74fc2b8ce88d","sha1":"93e3dae8ec3ba6e0a777a64dd3e7e7f126da104a","sha256":"1898fc78722d9933f29354fad9df20fd72f3575f5e697aca17015de6715fcb73","sha512":"7c0a121bcaa63e7f025a2a134ffd1c839538d971f5c0faa836e7a46f1b45e0066c47449efa8947a2a1ebe49d7b3ef8d832674e19778467ba834d7ac2f90ef3b4","ssdeep":"","tlshash":"73c02268c5a08a34082c10aaa878a2886480282d504264da82b94e8a688cf824548958","size":186,"data":"","first_seen":"2026-03-04T19:03:33.153521Z","last_seen":"2026-03-13T05:22:35.351532Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"254ec6f0c4d187a068ab2537652ea564","sha1":"1ae3948ba0632c6bae0905a636b6ad56a8283643","sha256":"34685c8c7a37551619c00e8faf75e9ddfb2a003162270c5f78755390f46c6c17","sha512":"c7a9a3132d43786621023e639ed62e349f6aa6fcdc32df6f36847f44d01ad8a93b87116968f64477d61d36dd473c1ce45f960db38cf90279e4ad61a9d2617719","ssdeep":"192:+tkdES6CIf83e2SXC8uWS6Ct2bjroSI3brZUqKfzymDHvCH:+ff83qP3rwB","tlshash":"61d17d7e9ed20637586bf5bd8f9b7080292284275908ed203d4ce1029f8cd3597f6f94","size":6547,"data":"","first_seen":"2025-09-11T12:55:21.590438Z","last_seen":"2026-04-09T02:30:55.24237Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/secureproxy?s=%2Fipfs%2FBO0qNO7wSd6XcRNdsy2ScQ3d2d80f2c34effac88a472e03ef37eb1%3Ft%3D1772650982205","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fefdc7806d1aa07251bdfbd6f6a8117","sha1":"cf6cf587f826436b0f9f0ddb3b33cb7303bbc5b0","sha256":"5073de17a220affbf06bb6c5ee246ba96fc2d98b8a64d5a1a05dcb57d9b2affd","sha512":"2ad5b120466b5333dcbab459050f25a722f237cd8f53b3248d95cb272cbe41897d1dcabfa94c3e4bafff8e90f09546684150edaf250cc063734cbfd874f8d42e","ssdeep":"6144:fh5gDKJjJJhOb1ntpwro5gxPoGeDtGXsdnrZtF6VHp3JTa:nsK9XhOb1tpDWPQdnrr","tlshash":"2cd4aac8873a967b44a013a7053792bfbfca0d7da24f8c607ac09cd2da6571e92f455c","size":610194,"data":"","first_seen":"2026-03-04T19:03:33.148886Z","last_seen":"2026-03-04T19:03:33.148886Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"claim-moonbirds.live/logo-1.png","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /logo-1.png HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 2711\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-a97\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epSaHSkJX%2FnuR67oxPrhVDXzWOSrTwwTAvhrJzICC%2BeEsVG7%2BuOEcceFk4%2Bo%2FXxJVKxd4nmA9t%2BQYaQKyCK4d0bUJjE5cxZ6IXKJqUOj%2FnUY%2F1fY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237f3c63aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2711,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 65, 8-bit colormap, non-interlaced","md5":"814c0b4cfcf15cf383774a8b3435a5eb","sha1":"98ec3d741fb3d554131e82cf9b74fac0f2026bac","sha256":"8c5b1b63b7b922b7fc4063a57110a03e8107bf60b4d41d0fced7345532db31b0","sha512":"05828b28855012a81e872269f472f6950b2376f14b524ffae676ed6bb2b8c0ec761c529c0608f8655a6ad16f75a36682369307725de1e772a891aed085a37df9","ssdeep":"","tlshash":"ef515cf0eb126d9c8d5ef6eac88358555e181c7b83e69ba14e83e2d318a5bc960c50dc","first_seen":"2026-01-30T04:23:55.374729Z","last_seen":"2026-03-04T19:03:33.140376Z","times_seen":83,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":188,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim.moonbirds.com/assets/icons/favicon.png","fqdn":"claim.moonbirds.com","domain":"moonbirds.com","tld":"com"},"ip":{"addr":"216.150.16.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim.moonbirds.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 29 Jan 2026 10:24:32 GMT","end":"Wed, 29 Apr 2026 10:24:31 GMT"},"fingerprint":{"sha1":"E9:AD:BD:2E:7F:DA:80:91:75:AC:E5:5C:C7:E1:44:B1:4C:71:AF:C4","sha256":"34:2F:08:62:D6:D0:86:D1:83:E4:8C:F5:87:DD:F6:60:5A:8B:04:FE:99:6D:31:13:6D:99:09:6A:C7:0E:57:91"}}},"request":{"raw":"GET /assets/icons/favicon.png HTTP/1.1\r\nHost: claim.moonbirds.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 41792\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"favicon.png\"\r\ncontent-type: image/png\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\netag: \"832b2c60fcd953f15828d8369e9b1e50\"\r\nlast-modified: Wed, 04 Mar 2026 07:26:30 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /assets/icons/favicon.png\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::qpszd-1772650982803-7cbf6de2c30b\r\ncontent-length: 84497\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":84497,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 698 x 626, 8-bit/color RGBA, non-interlaced","md5":"832b2c60fcd953f15828d8369e9b1e50","sha1":"720631529f976c033b099f874f90475065e30969","sha256":"62d94607452a6775fb7643edb97821476c6ab1458632953972a007649eda4749","sha512":"2ad5c906febde346be65504f622d4a4633d3711feba8002ab3f172276dd1fd85f947118ab554c0efbb8b3874ee1d5792be2eb978d2acf064e8784122eb585c9a","ssdeep":"1536:acvst2+Edoyy8tgnv3Cxof+CuUJblB73lw4GOBYQ/kN/z1TrHn3:rILy/anH+RUJblB73l0+YTr3","tlshash":"c68302d73014f5a25ce0247a2d9b23240fd258bd48c1fe7adf8a6d63afd4348e91e0a5","first_seen":"2026-01-30T04:23:55.370675Z","last_seen":"2026-03-04T19:03:33.14177Z","times_seen":83,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":152,"connect":1,"send":0,"wait":24,"receive":11,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/b239682e956000ef.css","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:01.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /b239682e956000ef.css HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:01 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: W/\"69a7246e-15e93\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rZx5ouD%2BGE7ZKeCwGqrpzzfNH0TGLqWxq5qGNUvqRKKxqZ%2BQODpR59HYRd5i7sdspuEqnlrq6hldZ7W0mKbw1Czh8B8TIXHMkmH3pXbQ5Lk9PBkb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d73237c1c0aaa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89747,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57353)","md5":"16b6b5da163f8ab8200ed5bf058ee2e1","sha1":"6470ec706997da00aa4fe5370bf6474e49223b80","sha256":"d790353d2e8fed4786326a8b1b6092f6fd952b6666797b37d20be675d0bd0a66","sha512":"5eba680cc13bcff5dc277a8c2921a47dccb2a08d7551b99e81b4845831d282b9d65da05cc5b7398849fa79ae3d84a66f047cb71c950ea5c79f7f0341ef7b0223","ssdeep":"1536:uqcuhQcVVGErMKtSNY4wUo0bQ6qz5WmE4sixw6Auiy+VK:uqcuhQcVVGErMKtSNY4wUuz5WmE4six5","tlshash":"479357597e5c3a3bbc13b2f5c1d4a89ca10773cade3e4797ac8112089be93f5295a710","first_seen":"2026-03-04T19:03:33.143105Z","last_seen":"2026-03-04T19:03:33.143105Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/css2.css","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/b239682e956000ef.css\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: W/\"69a7246e-840\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YPTJBzN2aaRFRj4kIMQARc79xIs3H8IYHLJHHFZBSsqN3TkfOPgjWXTT8oSxddpCQd%2Fc5SgR4RxLtelnTJE9m2Q%2Ba6sbQL2WAlN1JND%2F6I2QFj36\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9d73237d8c35aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2112,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"94008a89c8d6024db3d861cb7ba4a4f4","sha1":"51705aa43b6b5fe174beb82b06c56178246906ec","sha256":"0a0b13c690f1a1ed9e59cf520667bb9f3d3cee7e8ea89318a03f40ba9b9cf05b","sha512":"e54628d0a2daf050618534f61b4283e15f80ba17123dab3289050740e501a76d9dff62026199c6e2c7df929a7e2d7e3c56b0e22d47a4877dfcd71176264467e0","ssdeep":"","tlshash":"41418b80087ba504d7931cc122ce7e32ee2db19064459d346ffe1498fc5bd59a3b2b4d","first_seen":"2025-01-25T17:56:03.203401Z","last_seen":"2026-08-12T06:32:07.815116Z","times_seen":903,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/Oscine_Trial_Lt.woff2","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /Oscine_Trial_Lt.woff2 HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/b239682e956000ef.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 53644\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-d18c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MjGRiYNqn5MEfd1nj4Ud0l2dCASkxKUMOyz0Qid3MILpzWI7w7S6sKl1pk8RQQCErWsquQVDg6%2F5NioRDu1lz55V0mv%2BIyCWul8QLyshdkW3mPsY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237f1c61aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53644,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 53644, version 1.0","md5":"c1f2e8c63b2d63981e65fdccae1da929","sha1":"3590ea10966fcd0eb24b92b75d5be459b9e568de","sha256":"a64d6bedc689497d04e184904dcfb9fc9584083bc23139f3aa521d14f41f2116","sha512":"3ac96ba18ff625837892d9bfa31d2d575a6c1e85fe418a1e9e6bf810f7e77dd98b17013cbcd1d4e3ac733efb6dd261cd3fd5905f02740ea79ae11d497113e591","ssdeep":"768:7QjQA9C6cXRBlBheHVsjEQBzsk5bui1yE3WHBJHm8cTvIKDz4gb6ylo+lkr:S/cXRboVsN/bui1yIIuzTvHKwFi","tlshash":"ab3302d8fe30a287cb568775d2282ff850e86f26113d9e91336698d24d6ef057263620","first_seen":"2026-01-30T05:56:59.901231Z","last_seen":"2026-03-04T19:03:33.145269Z","times_seen":7,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":212,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/Oscine_Trial_XBd.woff2","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /Oscine_Trial_XBd.woff2 HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/b239682e956000ef.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 58540\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-e4ac\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eZYkyCZ8kHDt6DOq8n1s8WQ0uP3vRNch6TAlQKQct8zySautLI9Uu3NMZZRYGveA9CaRhWc6lbesidEzobc2wvF98hPuKkIlUU464yX2BzTIjcig\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237f0c5faa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58540,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 58540, version 1.0","md5":"d4a87a43708f045f346881c233c0e9fa","sha1":"c9cd2d99e62eaf68aad9262677785dfd6f1c0a1f","sha256":"245148074fae888a7692022cac9f434b1a055b32a42847115429ee02fa8fcf44","sha512":"79349b8a3006dda113b12bf457789416bb1826d059c14659d95c7607b9a842e86532dcfd7bd3cc8e23823091cf3937e04c2c4b03e97bc59e5ef784ec95eca3ae","ssdeep":"1536:4FghklrNNn/pTShOAa1dIFcOqbBRZCb/VrT1xXbX/r:4FoklrNpRcqVOqbjEVX1xXbr","tlshash":"3843028a82aac537edd48a706e97c6613b24dc90d0c736a0611715a0b7d07bcd22fafc","first_seen":"2026-01-30T05:56:59.896578Z","last_seen":"2026-03-04T19:03:33.14626Z","times_seen":7,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/favicon.png","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 84497\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-14a11\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 35560\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=onUqj%2BMeHVYUQ5pbfPQyr5EMt928KSpx2fYTqIjEXaWFcBkK4pZcyCC%2FkS1V%2B2OQKrsLsv8G5bWZ6nIEsDiDp99oZAmOkc5Ye1tlpVJuf4oCxhdS\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9d7323815cceaa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84497,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 698 x 626, 8-bit/color RGBA, non-interlaced","md5":"832b2c60fcd953f15828d8369e9b1e50","sha1":"720631529f976c033b099f874f90475065e30969","sha256":"62d94607452a6775fb7643edb97821476c6ab1458632953972a007649eda4749","sha512":"2ad5c906febde346be65504f622d4a4633d3711feba8002ab3f172276dd1fd85f947118ab554c0efbb8b3874ee1d5792be2eb978d2acf064e8784122eb585c9a","ssdeep":"1536:acvst2+Edoyy8tgnv3Cxof+CuUJblB73lw4GOBYQ/kN/z1TrHn3:rILy/anH+RUJblB73l0+YTr3","tlshash":"c68302d73014f5a25ce0247a2d9b23240fd258bd48c1fe7adf8a6d63afd4348e91e0a5","first_seen":"2026-01-30T04:23:55.370675Z","last_seen":"2026-03-04T19:03:33.14177Z","times_seen":83,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/secureproxy?s=%2Fjmpd%2F","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:04.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"POST /secureproxy?s=%2Fjmpd%2F HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://claim-moonbirds.live/\r\ncontent-type: application/json\r\nContent-Length: 1407\r\nOrigin: https://claim-moonbirds.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1407,"data":"{\"route\":\"n9POyFeFG1tUtiSU-z9JOx3n\",\"payload\":\"0hqM-6_N52QB6AK0AigACgC-AtoCFwD_AhwAAgABJwMAAO8nhn2XtsKCAaPZ93BKvcgOV7OFVGsCAAD9ftiM7HuQqFdZrA-joQY7-zerKCd9OnVVZrl0NbLQUA-3GyDUsPiZAjt-9tVKawe-u9OLRczPDTUWJrN1fqvioROPPfpMG5f5w6tgaVj92IfjaBBP4WF2WqKeq3zs9LiWxcp2LGm1Yr___eSgki5WR4-l0MQ6SCaPesGDKbD6S5EMdRUD9lgVvdd9yu1w2HqueUGzWvpMd_2gOkTamKnEAn5VMURduuAHLKhZKEUmHk0lN_UO3iD9fYGBsuaBNkcoHe4JnXeQo2aJh_4dNhcY71qGBoJC1ay-_wtgNM-sLZbnR9MbKUGw_kSpPHUoWj6ohd6WDRkpFVekew2S7XhJ-LC5iWWilWlohvJJzTez9bwl1PjlITwQ8D1OgdPhK_dKDjabWQH7B67EkQPAk9SuIQRIHo6Yz2rSFt2DfhR8bxDjJ-TIvIRJF3JbSJVR09DaEMOYRQD2QEBZFVIgQSJY60HqXHZr9LZLOUP-C9DX4_X1WXrhyhcPGXq5O888UZuUzI31iLScCdZKvOAAvDkEctXl5vOhme1133fz6R89Bl-eimAlZBr1zzQESab0JGaEO8KXyOeawsd_YEVplffc8HbnZO8k8qISndXnGSaiI2DMiPaSKOKVYLRmKrvx29CRhe_9tSPdlxQYcQKT2XpR4E40m2v15nakiM-riV8Tb5d7fRpEvObYd82NXoQIG41VoNPVEXt1NWNPvypskooUyvH2olPA1G8w0L0dQhBd-Ti0Jffo0_WDWd3XLFTzhnMIivcUtCNiqoMDmGN22MHcao7hCAlAcZkgh0SDXWH0-In9rBrMtv6RF5k1_Pcfpmb0jXzP7SYhIySlJ2nJ6Iqe_vVLkLVIuircTTpnph8fWudrc9slFij8RbVX-hWJgcb7zA2bMZdab5QfNTYmzl-4Mh4Rw74_F_SUc5ZieWt_DxYE6deXHEnCEo7jI_nCeiLC1_r7CW1-2H_1cRmiJ_OkuOU4B56tdlyV7J-5cHcP_-3oun464pQ7S9zge3KHL5rXatFiXIV8qpcq2JOPRkupxOXiWNhmuqgqmXbk8uzOB66sWOwVb5GH_Sd9flnj9urmVw4cvggYgRiUgBVFwBA\",\"challenge\":\"eyJpZCI6IjBxRU5MQmhiMWpiTDBlYVdPNl9IalEiLCJub25jZSI6Mzg5LCJoYXNoIjoiMDBkZDYyMmNhMTQzYmM4ZDkxZGM5NjllNTc2OTkyMWM2MzUxMDQ3MGQyNDk2NjI3NjgzOWZiYzZkZDljOTU5YiJ9\"}"}},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:04 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 10000\r\nx-ratelimit-remaining: 9999\r\nx-ratelimit-reset: 1772651044311\r\ncdn-proxyver: 1.47\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 03/04/2026 19:03:04\r\ncdn-edgestorageid: 1056\r\ncdn-requestid: f282b5fcb28b16ab3939a58d902df37a\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jz2gr45M8yW%2FkMeqwOkpX290RH4P%2BTCcxBzrYVMEOadu6K8ylg%2FkYN35bfsAqMGhlwxSv2imOuSF81C74i8hX1CvqqlswIDM1AM3BnGPHKmFiPZV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d73238ace98aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T19:04:39.868583Z","times_seen":17906266,"resource_available":true,"data":null}},"time_used":821,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":821,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T19:03:01.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 04 Mar 2026 19:03:01 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dRgAWvSAkATwlTNNUt8fluWVx%2Fo13ShEhdIER9wZl6QCulKd795xd5Y9yvrYDPBoXxCRO3X3lGGWGXOYhwCDJ4gro4QRaLTJwteJzhAuXF0hPYt%2B\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9d7323797a1976a9-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20012,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (698)","md5":"62632ccddc02e19c0c5f8bc76e7b528f","sha1":"dff44ea4040c51b6e8189110d237eba3705327a7","sha256":"22cca3a7c9ddd5ea79f0d7a1f3780f46d47d17a35c9e890dfa2405f20f81ca9b","sha512":"95e68946ea83eeb00dbd0b8ccabe3778ec2a942d0a39aafc7cb6793343e36606f389f58e026f012031cf8959d565a0e6afea8d4a791fb7f8975349e2878a2cbb","ssdeep":"384:3sGviMXlKlylF7M89uFkyLG8sff83qP3rw+:cCXoyX779uFkKG8sff86Pz","tlshash":"4b92b5284ae201379467e1bdafe6e8063930c403d90bde1d7adc62529f8dce5c9f6359","first_seen":"2026-03-04T19:03:33.147746Z","last_seen":"2026-03-04T19:03:33.147746Z","times_seen":1,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":55,"dns":27,"connect":8,"send":0,"wait":208,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/secureproxy?s=%2Fipfs%2FBO0qNO7wSd6XcRNdsy2ScQ3d2d80f2c34effac88a472e03ef37eb1%3Ft%3D1772650982205","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /secureproxy?s=%2Fipfs%2FBO0qNO7wSd6XcRNdsy2ScQ3d2d80f2c34effac88a472e03ef37eb1%3Ft%3D1772650982205 HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NL\r\ncache-control: max-age=2592000\r\netag: W/\"94f92-z2z1h/gmQ2sPnw3bOzPLcwO7xbA\"\r\nexpires: 0\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=Kjz5V7wsjyQ2TNVG_lCxcA.js\r\ncdn-proxyver: 1.47\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 03/04/2026 19:03:02\r\ncdn-edgestorageid: 883\r\ncdn-requestid: 0fdce6268daf6e8b9130f4efd35060a6\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CwMVqhfw5%2FJNj%2BawIztW%2FCkw%2BnKwyErugYOhnhp%2FNTidF5GY1%2BWSzBOcJ50Q%2F5%2FOs6duAXwY%2FG9GGILgD1KwUmYXMiOk53Xx%2BDxtTc8aQKt8J6SO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d73237edc55aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":610194,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"5fefdc7806d1aa07251bdfbd6f6a8117","sha1":"cf6cf587f826436b0f9f0ddb3b33cb7303bbc5b0","sha256":"5073de17a220affbf06bb6c5ee246ba96fc2d98b8a64d5a1a05dcb57d9b2affd","sha512":"2ad5b120466b5333dcbab459050f25a722f237cd8f53b3248d95cb272cbe41897d1dcabfa94c3e4bafff8e90f09546684150edaf250cc063734cbfd874f8d42e","ssdeep":"6144:fh5gDKJjJJhOb1ntpwro5gxPoGeDtGXsdnrZtF6VHp3JTa:nsK9XhOb1tpDWPQdnrr","tlshash":"2cd4aac8873a967b44a013a7053792bfbfca0d7da24f8c607ac09cd2da6571e92f455c","first_seen":"2026-03-04T19:03:33.148886Z","last_seen":"2026-03-04T19:03:33.148886Z","times_seen":1,"resource_available":true,"data":null}},"time_used":812,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":726,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/bg-home.png","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /bg-home.png HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 102126\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-18eee\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8OItdb%2F41ymW4lSssMNG%2Bs7fazGctV2Dmnwzq2AVQTcpE%2Bb6u7s94NaWr5V3pOF8IJKvZjSIjJ4XsD54lLvmpS02D229S33pMU1jQBSXNMGx3d9V\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237efc5baa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 6000 x 3750, 8-bit/color RGBA, non-interlaced","md5":"4d303c40f300cb64caff7f75a332e69f","sha1":"8c1d660f648c79cf86d40d196bc49e5d78f1e19a","sha256":"f54ed1e62da50259d56ab48cbdb7337eda0ee3d3752a4822b874abb6262518a2","sha512":"fd004ee04c65156b2bbed48984d558dd337c9cdbc88903c6a253eb00a1e779a179a4793e813954ad5cc3f057df0001f8a77201fcc45779376d5e96baaaf516bf","ssdeep":"192:iB3v/e2DU36Tv3r0HlDY1ah0k4uN88CO53lihgome9yqNEA:4//4Kj3r0Hl01EN4st1wLme9yq7","tlshash":"f1a341455a2249e6d41448b29e833ffb7bf946051261db5a9fd4ea7038c31c3e3a39b3","first_seen":"2026-01-30T04:23:55.373348Z","last_seen":"2026-03-04T19:03:33.150144Z","times_seen":84,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/Oscine_Trial_Rg.woff2","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /Oscine_Trial_Rg.woff2 HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/b239682e956000ef.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 56020\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-dad4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5dtxmn6pUh133X%2BpHAXy6g4PFwDru%2FVDAmNVOYz2omnMhZTOXrarxNhv4oUYiHiGEDRK%2FiX89E7AhP5JuLq%2BwA3xL%2BdzYAnWbRRlAkexrp3h8afw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237f0c5daa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56020,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 56020, version 1.0","md5":"f4a7d69390e37be3c8e07333b457004c","sha1":"e022d34d97e22a4a979a08204d4b48e129cd6663","sha256":"c1e49a25661d8acab90823c5be34c79750e0d45b2b8b094f58962f78fb943ce9","sha512":"7cef968728b7d19827ad543068506703de88d006c3a4d7fb6963c4fdb8b8ae7c4899a6552a75dd6b09a60d51e4673c9d7d27955e93d00cc9992576b16bf980ae","ssdeep":"768:Ni0bfc540daZ1hKmQKpphJjI0j1VW3YdgCucobva8viut7DJOKhVXhgsZmi0:NiefZZ19pD00j1V2oWva8vhtOKhVXmW0","tlshash":"0b43f25605c054f8f4d5917aa3a4bdd9c91ba1b0437b08c28a633bd855eb7c8a3387fb","first_seen":"2026-01-30T05:56:59.898958Z","last_seen":"2026-05-31T11:12:46.882896Z","times_seen":8,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"claim-moonbirds.live/logo_bird-home-1.png","fqdn":"claim-moonbirds.live","domain":"claim-moonbirds.live","tld":"live"},"ip":{"addr":"104.21.40.219","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://claim-moonbirds.live/","date":"2026-03-04T19:03:02.273Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"claim-moonbirds.live","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 22:10:00 GMT","end":"Sun, 31 May 2026 22:09:59 GMT"},"fingerprint":{"sha1":"41:3D:D8:E3:C8:8A:23:7F:5A:74:59:DC:42:85:87:F7:70:7A:D0:61","sha256":"DD:9B:9A:8E:F6:FD:2A:DA:D8:D3:78:64:F3:B4:65:E4:BD:A4:CF:02:32:16:67:27:F1:6B:B5:C2:1A:0A:04:5E"}}},"request":{"raw":"GET /logo_bird-home-1.png HTTP/1.1\r\nHost: claim-moonbirds.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://claim-moonbirds.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 04 Mar 2026 19:03:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 11952\r\ncast-mode: default\r\nlast-modified: Tue, 03 Mar 2026 18:11:58 GMT\r\netag: \"69a7246e-2eb0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JU51tinsUuW6j6lbdvMqVCN8J1gRou4KW8RRZh39fzR4Nz8kDoU6ev9l8RiogbxeKeZ8LCKP%2BThsEiMG93Xwi02HeNW209%2BDRmYBQbg%2F0%2FrXzN6g\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9d73237f3c64aa04-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11952,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 168 x 148, 8-bit colormap, non-interlaced","md5":"f13114fd994c20030be7ecd242870041","sha1":"18dc87eff270f1dd3f2cbdf049db4d9d75906a30","sha256":"5dc5f6327e915ac5c904e113c7f316f59adc2624021e87c35ee3eebd426b4fa4","sha512":"4642dff77c75590691a5a5a53f92d84485a854126c66cf9855ce42b7c3435d5ea43c4da2e47ed87cb517a5dff42ffe29fca6eed6bfa53a07f162dc895a9b84af","ssdeep":"192:LaSdg4L0o2k14iN+ALAZmJX1cz4q7nRaUckZKrvy7mYTLi1UIq4/ZFlvBzTy:LV021b+ALA+Xiz4fRrvy7HTLi1UIq4/G","tlshash":"2632b0d759f878e278e2429cd75e80f40adabf6ba526c35c24a4c0451f8c1f219ade98","first_seen":"2026-01-30T04:23:55.375642Z","last_seen":"2026-03-04T19:03:33.152508Z","times_seen":83,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"claim-moonbirds.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}