{"report_id":"f6146917-df8f-41cd-bb88-ac08eaa5feb3","version":6,"status":"done","tags":[],"date":"2026-01-24T22:20:27Z","url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"172.67.130.19","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"title":"Moonbird | Claim Your Soulbound Token (SBT)","dom":{"size":344,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (344), with no line terminators","md5":"7f24dc65ff175d0b3c68d0853f3418ba","sha1":"11e1b7a2380887f526fdc0a5cfecb4332ce5d6af","sha256":"ba16ffcf3d0b3457c2124de723feb588e9cc8a61f1c618271b3aac66d1b62fbc","sha512":"c03995c008015e1d7127d44be9d4b6d646f4beddf87155a29331100ba33418069b6f58ac9fe7c44ad9cdf13eed37f1f8d44a03a33c66f9f2a9337ceb2849ba3e","ssdeep":"","tlshash":"07e026ea2d79c83479f4038a20f5e3dc162072a0b715e74442d9d83aaf10fe74c92998","dom_hash":"domhashfa92bf49a0529f3ae8099507699ba65b","first_seen":"2026-01-24T22:20:30.219802Z","last_seen":"2026-01-24T22:20:30.219802Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"172.67.130.19","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-28T22:20:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"moonbird.run","ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-24T13:59:38.536971Z","last_seen":"2026-01-24T13:59:38.536971Z","alert_count":54,"request_count":27,"received_data":1286697,"sent_data":13179,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"www.proof.xyz","ip":{"addr":"172.67.174.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-12-09","domain_rank":0,"first_seen":"2021-02-10T23:33:59Z","last_seen":"2026-01-24T13:59:39.085673Z","alert_count":0,"request_count":1,"received_data":5921,"sent_data":431,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Algolia","description":"Algolia offers a hosted web search product delivering real-time results.","website":"https://www.algolia.com","common_platform_enumeration":"","icon":"Algolia.svg","categories":["Search engines"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"moonbird.run/animate-js-1.19.1.min.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5294d4eb39dae48015394e87325b1029","sha1":"7b234b15c0f23bc8c1aae41a23f89bca2b962e59","sha256":"81e56777f84fe4c084be67070cfa4cab9f4e07dc27bc0e79606e93625d257f08","sha512":"ac7b524b1a7658bf9a261566bae17ddb4d68cd9e8d112df66355c11baa027dcdea717c2aa2ccb98803c25c89cd9f810d185237f0cbeb3b42a27c7ed6e5732828","ssdeep":"768:Eb7jQ3cOQqJ/2J/7jaYncR6SkLD4tTsNBuKq8mdHcncOtY+cvEcBpLTOV2eMinL+:ESE9jr58tKrmdOeDiCcXmGqD/h","tlshash":"099371d5991bd0d58e5220ded433e809e4280a63cdadf2a3ba6cddc1785df62c48763b","size":92219,"data":"","first_seen":"2026-01-24T13:59:44.524516Z","last_seen":"2026-01-24T22:20:30.229865Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"045650a33866b2edabe97ac223355256","sha1":"fd460f1a87b70011e4c699eced10c56c3259b6ff","sha256":"3d43ebd4a0556b6ebd9e97e1fe40123ae98ac7d521d40d4eea45aa0edcb0e159","sha512":"68e27292d6e102a26df6283e99ea15e968524835ed4be6739a01902c4f027d23f36e98c575593481606c403f778215d2060c73f93775ee8587db10b7bf5cf5e4","ssdeep":"","tlshash":"ec11d0d89013032f1dcb054d59fe4c8937eacec9a208668e8f4950a54dfd4b0734ae0e","size":1034,"data":"","first_seen":"2026-01-24T13:59:44.526306Z","last_seen":"2026-01-24T22:20:30.262025Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"895f526ab37305311d1e998fa4d5a6e8","sha1":"06d0220830c81bf254c70552e908371c6dc1f18f","sha256":"90916b8b1fb2fbbd765a22eba866c30d8829f59aa2d7ee86869abd20207b2117","sha512":"6b087d2e2025f4d11073254448b124af8839ce24ff37eb45bf2fd1a2b66bee8fd4fdca2b4d23c08786d217dd71dbc660d1054b7876b37752dee3baaefdaeaa4e","ssdeep":"","tlshash":"2871bc3beb00173bdc8fa9fdced5b4c02e62497262496960691ce102a16cd7487bed88","size":3743,"data":"","first_seen":"2025-08-14T22:47:51.287187Z","last_seen":"2026-08-04T03:24:51.613091Z","times_seen":1391,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"46fa00878ffaab5838660b8596b51930","sha1":"851e24de73f4645c8233de88e9e72c05d6b231da","sha256":"ae31e9c248d40e3f200555c60c8581e7eb4552078316122e3601a16b13216a50","sha512":"e3eeb2881a49837530f2226235d543b2db08207a0d3ec531e2072e7cbc866a558eb4500dd0b9f27890464df5f713f60116bb44ac17ee054c222f17452337299e","ssdeep":"","tlshash":"7fd0a795297588306598024a20b6d3d9666031607715a24081d9cc2f7a51d9304a15a8","size":217,"data":"","first_seen":"2026-01-24T22:20:30.264745Z","last_seen":"2026-01-24T22:20:30.264745Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"97816f25fbfc43e1627469fccf7c8814","sha1":"3a3c729e6a660e7454c354448b0c3f4f8911b023","sha256":"19f10988118766991a409ab32e7947946321bcb04427089734f62de9fbd57d19","sha512":"ee34696419d3182e94161a0d0c4ad4b55fa2b048dd14179e08ece2b03065e843997c2890f3990a534f8c49c2b6ae202496507518bc65d00cab490bf1e2cc298b","ssdeep":"384:qRoz9jDdTpSozlD1EJgRy45feYK6EXmnjZn:qRkFNzlD1Ooy45flg2nx","tlshash":"018289c93ceab55427be78a8046f31ffa3aa6e5270450f15c220dcd0bda0719976bf58","size":19070,"data":"","first_seen":"2026-01-24T21:38:17.881372Z","last_seen":"2026-01-24T22:20:30.240191Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ee4428288f34a753bf1abd6a8c73d5fd","sha1":"024a3083878c520efe8673cb7a13d86ba66825dc","sha256":"d73a7dac9c964651a260a777f4647b7df0c0fa6264ca299d6c83d09d8e5f8b34","sha512":"450487a42aad92ee648d1fc3d3fe89d44b58ff9536b2a46073dee954ff63685e632cc1b84dfae88862e61a3f66b10977bc8131288a8dabecde8fd7acc41ded7a","ssdeep":"","tlshash":"371104753b195534c5c5414b317ee7a93e3220317b02a144c3accc285d58d8714dfcbe","size":902,"data":"","first_seen":"2026-01-24T22:20:30.26666Z","last_seen":"2026-01-24T22:20:30.26666Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-04T03:31:00.118866Z","times_seen":414114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"moonbird.run/6761.bmp","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /6761.bmp HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/bmp\r\ncontent-length: 5430\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\netag: \"1536-645a3d85b3d5b\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jF3cfnLkkot%2BQNiujp0pnhlBGAYReC5I2KWK1JjQZhgiG9Lu6knfbVUX18EFJejBuKOMcW%2Fqvzry4qWXeHoMpgWkj%2BlmORwuk5s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8dd86856a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/bmp","magic":"PC bitmap, Windows 3.x format, 42 x 42 x 24, resolution 1 x 1 px/m, cbSize 5430, bits offset 54","md5":"58fb99a5d417e637fe04fb1a78cc2c1b","sha1":"a8822f37ab8f2ebae1fb8db304b80ebb652c5dca","sha256":"f1b7c9e590d4a5f8ff00830ef24d210c21b37b0529ddfe48127fe51833deeb8c","sha512":"894617714d3d66686f42c44827f64fefa69936fb64843fae8b8ee929846dcbf3146f6aad9328ce39c447a6518e3fa41bc65f665b176b6e7f72ea8957ee3f2df6","ssdeep":"96:6+tmAoBhQCUAbvvcTGkyKkIv9MU4w04AyBnJqSHcm8HPBBBb:q","tlshash":"30b1e422e0cb874a492f133b2f198b4ce65afe5b8d045bc76d60701562f746af1f86b1","first_seen":"2026-01-24T13:59:44.514632Z","last_seen":"2026-01-24T22:20:30.223457Z","times_seen":2,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":420,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/challenge-platform/h/b/jsd/oneshot/d251aa49a8a3/0.5809739697929515:1769290002:C3XtoYylUF6Jk9M2ttjAv_67SHvY4ulFx2YUhoweOCw/9c32ea873ce77129","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/b/jsd/oneshot/d251aa49a8a3/0.5809739697929515:1769290002:C3XtoYylUF6Jk9M2ttjAv_67SHvY4ulFx2YUhoweOCw/9c32ea873ce77129 HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12137\r\nOrigin: https://moonbird.run\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12137,"data":"NwY-ZUEFr+TsEsECPoY-v+-TPu-T3-EsPZPac$P4+PeP5qRF7YxrJPHP679qpPFEZJPT+JEP+wEoVPn+$YUV$w0Pl-Ap0PaXRrBpPI0ZedPFvE4hYKxmIULPtoHio1cDbYPaFQcN4Yg0uaY6P-YPTQNRYj43-9XE33XV49DPwYENFYyYmNewS0okS0+PnQREVYTrm-Pun$1vPs+q8qiTtKqPd7pPZqEaJ7sPbAIdayECj8MLYbaJzxLPpYYPd3pPTm9k7bQuhtBPCl6mGipyY-PRnksq0APPQQ7pKAEmF3PjKUX7+H1uS3YPa3pBTwN9+MefyvwE90PR4rCafpBqPE$5UsAZ-GRRnRZn4PCLxP92St4PrYqsRH0lAb4Puu7E+abfUP7MuAM2o7$NaK3nc+15a$cJx+Natjqcr5wYP-X0x8S5-P$dkUwXkUlwF90hk+pl+mlsvX+O1r20DK4PFQRYT30ifYyrAaa1CzPEBHFeLIZyBLEkZTuvlAilXL6VoSQxddcCucPnZAYyR6JfFmdgw-IEfUNsmJ4kf7G4G89YGRxXjygEb-k1ss0DCqCmlVw2G4TuGdqlG-IcflrGCmM2PT-D2Ldhp9GzTCpeoJePFaOYa2xHms3tzBNE5uL0K94XCmwFb35z2E2k92diTwMxxoCy5KM5-ejKYBKwDeOfXR89Tw5kyVwYkX0siDigYT3adPRop5kBn8fUHP56px4pxMoy$-ty8eCgiAk6KAZnFfJMUEApT95cYDZnKoYGMqw88sAP0r3M-PC1+5YxJsRYtPkT+QRJr5GTYCMZH2nPN-5RwK-ls--1l8pBkfKBe$GCG5aKRYx-LK0BrmCB--2N7Nvw+qK9GZ0$eGrYNUaRYNrsYYVPkC2wLEC2KraTqaEQC4NrUnPLvUJYpUb9h2USnPK9UTri7YsbYPvKrRPLTRFQGa4BPT9Sw$L+rDlyQkxZh3qwexP+BPxnRB7PxF-Qx9qRTGa2s0m4mNr7BxPlwT+p$SR2wUztm3uD5YlQmPsqoeLkErTV+2meV-ndkx0RE2P3JY2+uwXXAuSaoBsluRaB3QHF4lulJRSdDVmNLF5aMZG93KTx4r9nIBFiTxKReGVdrtThV05oO+NQo09z32PY124RBPDCpSZYUYEE0E30UFCRQRO9TrNYce6KGT+0+qDJiESYF5dsZnaP0YU1$Lnqlq4robNPUrXK0Ho32ST3aE-Tr84SgBurMBmjrMu3-N-R0bKUnatNaL32hYlZV$192wkkJSYecgYo9xvBds4CBAK32s9cEnPcQpcPRL8o2$cAYxVE-YFtAgnPaPlaR+vx+UxedKy5LlRbMUqiRMa9V1$-fPorZztRwt-a9D271xVrUYpBrlJXTjwYxNEEZiiTGJLijG9UOm0JlYTXt17eG+TA-qxsIs-Kv-AkK-gskJqYezwZgTLkBA-v4BijD1jI5n7KTtsa4+Ow+T--fYBlqZvQLepGsMOIihMg2-xMOLi7cUJl3Fougi-H9DoQ0-ZLuvQcVtOx7ENOJCBTOpGOvOGCinT8v8XO+PPTVHwReJpY4pTIHGP-dp+PSEQLP+OpOKfNNtvxn3QlZqMz4RBaP4HYqqrSR-YYo-jCYPvUERd9VdqhzfPiRIXXAYytZBPT0gTUEBhBPBL$fU2rN8-C$REfT+K+R3v6MFxx7ksrYKxiNHJNjo$Hd$DrXHCR49Ur-MXSTy7k6oFLn3LPLT-0rY74$mIGrr8oQFemiTgRwRuRwtkQ-97MRBiUG17EhZETXZ7IUUiFfsE3m5OURLEKskUFqI-x$ZrJnwRfEPw3YUUV-naFoLoafLBUr$t0niijL00PBU$dTbNLLP3y5LJEXYp3+N$RpE-sdtzl54Co4URJxCYuBBEeMM7xBk9YEEeiLepKun--ow307vpk4YFL4X-Ew+TYGOXpG7JJJLacCutYkr0K2SquAx6sR4PbbczttBhQqnFnqHA2MDQs8RFxX0E$44J4lbAxc+XSR59sza6vBqSj6TSkPcYfcpepCU3Bhm7TOTdXuJyPEyF3L$wxR+u+X6Jiock$PhxBbhQk-yjCZyFGqacKxVnUR3r3GzxMRZFr6oRRrMR0Pz40CMQLg6aj++vFGINylGnATHa4T07Ej3p+tL5tLnX1rEo20kUpJ0PrszlXA1XudbALITrynyK4RIBpQKN53jYJ3ozJOZUAtTG3JTw6xBxFrmNNwi0-Yk7JXOZHGdjAP+5-aEK$wUSoqgyjZQpHoikBPNTLK6dr++lT1Mv$02rI-c7Yki-61LE0i6RFSoxTmnLrKmZ7q2ACruZ317cIr7lEIXQXL6hu-PDhYsuMYXl37dV-r2NN7rJ90nVCzguSPxhyy4FNRqi-7iN5s8YBx7EPxbLcM0uIByDP+XcjNNEIPSjBa+ONuutQOKAEtLbwkf4UEIorSnYEO$u4DnP+3EcfPb71sGgy+H7T+xJnqGcQoPnJxf5nU2sz43xJEb514ucIrFdsRd8zNFMTrqAesecpaZGm9JhKoXOIPfkjahYaBNPykm8qZhgcBEBcMfDhYBDEEofq8+ZBr-sulGCaYNhOXH4qPQRM$oFN8TgRErEQhkex+xxLsMt2eevsfbAxEu0-PUzT9bBM3PcK$ZqxC-Z23HZOto5xLY-uTE55pdRkSA23yY9ceTRprvRZq2tIqV+rNenMrEiJq0fIZdL9qTcINDXdqnRwQh-U6HmYZYR4-kAzmP8u6L3cOmclzsARfeeuuOmE4+-pm-wGhKwPA0UmTkuAr+KZ8Aiq3YEHPiIEtLYbMxyhn0ovCgL7b0DPhZvdNu+Cj++UvUp-qNAEidoF+9$fv3iGbP4MGpHEUe8CcMuExQx5JVRpMgXXbSZwL8xu0ByIPD+1AwsHa3Rq$XLr0EqpYMQAhRZ21$XGfmSMRvBrQ0Fv6BI$ydJYt-5lZIPUkYrBqNdmk5P2Ra$v7orUlRw5UR1800uiaOdG$vsiRoY$wxY9GD$or05$pDyBx6qTPq2N4u-EPH1QCFiFzG5dMPKCrMxOvFKH+yNxV0j9fC1+6TO8TF3c2NETYT$b-s4oC+BsbwkLeT$Dz1bjB7VpEEUXTZioBRe$9jiX+X3dA0SaKpcptsaeIHJ-0eZndcHyatNw2qgJY3aKu0V+VDoGsbDxZG0aa3r$Gw-si0suGoJNwUjaLCEkxxTyo2+uZdb2DcZE7aQ5O47LIbG9Cu++93RDIHAKkV+rXm3D+J6bt13ZL5uogGn1EKNlmw-XF-Ec2puowXfevsg+RFAunerd9qu0mNK+Q$GVvMNHtUlXKhgAIQfqjXZI+94PKs1NNqmEhfl5p1yZgD3G4HEG19ZcXg2SH3aUG$SECziXn7oyKLuhwhXFadK8SEyH8deb9w$RCYmBRi03qNKx6h++IsPcP7oehUR1g1xYq3dcjG5g+dILhS2UcgN5rYLfIMFGN-tS9LB+2JNPZ4252sNMqhIL1-Z4iMHPvsmxOJIBmdUGSgln8JY5XLGw2GsfRPU+U-uP0Y4G30LMLn1dPqmdaFIq9qCn5nRE1LedKY4nqEDkpf8dY2RJuJs00qY21FQUK3nsydkSYnK3lqegD0Z2$Uwr0E3grYI-IPlCw665IJMY+xFxirmPMJwUZhvkIhJqaPms23O-0Yk5K+R5hxUJL---9+30lEwMFG5ndEP$+s4EI5zESErGcUpfkgh$H3nc+qh0Ddg$l21MG56dR+xYl5sUwk+CFL-0Xs25EBR6Q4Rp25FY3cKPJ0TGmgm+zgdCwMK6hkyLrCFx9M7UI+cY2hSSY5uL0gohl$RfB5cE3JR$bEcSaPr$rYUG$LrB0Ar5B5zA9fS71xo4G3m+KPAPY7GcUAGG$nIBl$j$96V$YPIrFpLU2nkxzYuAYhm$jkGw9qtns0Krjxlqxfw7VSChosZs8PigQ506lggcHJc2ZUkJ+q2gRGsgy0+YiPsdm+ddp5FLUpDJN7wMPqx-TCfEfdTPMd95v4JMThx7H3$d4adnq6RFOrN-TgdkrFxhqd+YDsYfTGJqy-FL3JLEwgd035IaVclr2YldTGsMA3cP87HgA-Pa+fD0RPl$-0q0YfY5sgI+bqZPL-5+9fY5hxl4D0R+77hxecSY77$Ly56SPycfALGS+-pEj4wE+s8Cu0-yYyaPuP1SH7OC+Y7A0-2p3J9rVdY-9rQrj+id4yT0gAn-3Yps3dXGppMFKPZPlqILer3JPxCwhkAEjBy64G2nGgKPfgv4pfkxkajaFL2pq3-ESY35KrhwC0AP4Cy-q2p-IrXqUf3bRPVA75NPHGqY8FR+R5$L9rZqNP5GZ7p2vyXa2f4bB7PJxbry2nV3KPTP5bmfKJp$PynMmFyn3Y00$f9qafYYk5I+q+PbBPgFM-tSIbMMT$kc+gyawk41vk25JxKPJ5ZJPqMrSYMfkbncF3uCDg0klbU6JaraA3jqh000D10JOnC$6GSAdcDdgCQ5xbH5Nn3UZcVqpf6J4-Ibwy-RnESYY7BELYHdA-GaXr3YAPjgs6u3cEDEgnPR6Af5YE-RzY9PnwZ4vAPRegvgmR008A9s1cRbBCmbGSzb2Cr1Rpa+A-1MkxA2m-o4RpfGlry$mAust22261kRz52RC7hcnGtSoxZC57PqFXDPOP7-Ey6cTaSSYC42o+BaB$hsZ2wgl0wkVAJXUqmFw$O0k$EsmF21AJYP2pzP8+iX3ECxIPvgFX3C1L+7TPF1na1L7gihG+2cRgDFUSDXcEVAxbdUUYnF3G77XdP2Mb0cXE6crbTGYncYNkVPekf5u0UCV3Zqxq1-u5ZG$JIxog332$KbsC9kAXo23JSdl6HCUSuMiuIGmUjkOgVXEc$3tnEPF5srMXrYPg2aJU1-E7K$+YRSh0s6R$dLTG8Xn6zyw6EByY-3KPenM-xEM6+spf-mQ62pxqMFhns0-7FLA3mPxRYCU1q6gsk3kSoxDs+bYhMd-aahgPfuy0fM7aDSOqA32Lc0APlAd6pfC3T3iP9Rc0vuEJp0ZdU3KRBaH3Ng6y0u6c2XL7PR$LIbqnMu9a8RN+x423LaDXmFYgvsnuDNFAJ2OdINnsgcy6yJVAc2q-OdquI1am0YnsY7pwEg7-+Nkx2qlGFuhLod+yY0jA1LUpy3xxoRkrBF1L7NpXvajkou$nx+ZcPMp0BNP053jk0-S0vfi6vhaPagG+QXlhxmkAozl$CbgzRr-YBcV5B1-yXmmFkxCJnsIR7Rkx4un7Rh25$fL-A-c1XN37wg-E2GDP4-2qUqImA3X4GmjmRpaGoMRp1auFkS$ywRTGA3MATRNAx+HP276c71hcTGwqYnBnaPq$1b5gBbB7N-k7ohoxvFlq0mKre4Ks11rmRGvxhJoazEVApfOLjFPdhAA3n6qnuMR$cN+hfNkyhaSRfdod23+uTPinyqhhkb2shRayIM4UYSwavzizlqJuB6QFFxVg$-FxezHLyuo4A+3ARrc2cyR5u5MS-hnbq5Suz3o2nh$kkfVzU3lpjplaSaBJMYSEtP06zFi2A-tS+A6GPgcA$$iy-EK+7zKq$AIyX6ca7R-yHdUYoy6fs6TDmh2GodD5EJhmBb3Jzt6+Jq8FOmamNTQ4UprtyR25kaM-ur30jX2pnFdc-Y50TFuMOqrcd0IgkSy7uMDAIFK5KAfaR+Hz2$1-fJke$stPL$vuods1TP+NPxy03xfsxaf0SCPR652aYakSK3K3OqcGnsR5Ttg+fr0+n-PoUhth-R+YRasYTGhx9mL-kJi2IL77YnyYsLsBGeADYPYte4Q5se0-MFI+Ocz$U3bqsnAfl$eeZqMYqxmzqaQUkSIbI7-q31BTCNnzRr$LgtNNpbtN$NeNvNccyta37-y-UGRXQCBbYeFrmE1upmQfZgl6eMn596Q65bXbwC3X0CMF4SpfUCcC7Ubdhx3NeM77gbm1y0Bva-b-EX5yQCC0ZPFaTR$LzYgmPR10JSNPR2kqH$kDx+nsR$srPJR$5tse$bA3PGEhxM9bfAI+R59tuMx$94E$T-bFvbDEmPoEqYf6Erx-4s-S-uG0OGZe4blyAtuGhwj4vvzGK-qCPR-$9YbDP08PA$PzPJvtFLVgNR7Rruz$G+-0c000xeqpU7pXYdK+n7xdgT0euvM-Nv4vB1GNp-4tN-VXFR9N$Nqzx2M2FRHXuMQtKtR+JZpf8AEJTRUCsB-ZDd1-STuPcDUFAytyyyoRmulZtt2nKZTRoxXTyzOXxMcF2FvoxM4UT5807-pfoxatznpgdi1cCipz7nxXXtPCDXuxK3pfMxScUcw-Yvcuo4n0JMzbtof5K+8daxkEgyZNE5zEc2HqlqiEYeu3K4oyGh7yxtFLyoH3quXhIX8t4byAAt2e1tiNyyz1H3yny0xyjnvMZAqvZ6c6dv-XkCtbzYrh$cob4b2X3TgNtIjET5z7ZD157dBSR+IDAxm2w-aeN-lzUEbNw-k3dhTGLytPZ5VX6h+YH6uC80IPnhK4mTl4iqluCn3YazdDcYMehIlqQcBttaattZcz1oIPi-KbNITcqq23jkLYpNO6P3LzBIEJI$0ooXDg$-zvdTCT9s5TtSYGHJjdUb2hm-cqN-OmR5ITEJ5teThHAxOoJGlNUIM2BzF9btXFp1ozkxqzp-UbuChk-JL6LUOkh7BfOtPzKXTPZcyIL$2prhOkCa7xDcuDUitv-RybY$VXbgo65IUHUGH6X-R56JaP4UiFLqAeOEeJyyTyO77nHJYenc5l4F81UbIBhnQ32duyLY77oZteZrEHmHf9dS7u1L0vQ7ismzQeooGuEXpxwx6o6ercbE+9yeRGUtzy2zCCdcUG8NSIoDXRHfurYYpgL-hDQoU3oJQx6+53u1Nfy0gXLGpZ+vYmlpGoN3m-ZQNaRrhyo2$1ZgLRBfpwViFR$C7CpiCDo9xRSym18Jfm+cFct6hIYvzY+b6-hgylBuc0250v3JOZbJ20CXs6a+yqK+kZXRMtVqLLAtPtqx4uCGUXPRPuLl-Z8f3MO6goxEOqEFU3OcAkpX2ewX1MIb1-OTmscCOkG2biYACwtuFxbE-ZTRXzk3-ep0KeyG4-35NHxI5A53zHtDSJvshxVi3focJR1oN$zjdUHqbHgKDLYbG$mLAtHG0-mT6N2xXZCYi9K9QFyK1lRKtHYZMYmilqvrztn-pXcYokGkk8X5dt4jU3Dmn-g$QG9yYRme5gpwatLjACy1PdcJkoE6f$SYUG$5Q4rnf24i3pG23LLYPDS5HRIBcPvluu5ZbmG3pfVbssLyc-xyICShtSUp-3n-D+OkhDv97IGljfflq0uuUUElAcCMi8NPl$qMK0SeUeh0ceYYAHUulq8d31RH3UnMX1vbibxMviR5IbgGy0sJb0Ho0ofM4oYIBciokS-cqcxMdRqKu0NEkyVA7N9V8VD8YP6NqqJiQl9gKljL1RwM+Qb$Upl$kOw6Vy6Ec7A38LOKeZUDlN7NxbPGU82JFjuLzlMvn-eAp$auFLUz9kNEsyk3JVVq$6RAEe-1X81rB74EXAaeB9-bp7eUY3PBE80YHE3csX7P7EPQU-YrYfA-Kp4ycDewSjnSat28rQy7daTB1-PzGRUM1raZPumI$ETLUI$tBsjoNbK3CYioY+nmqbxGcfa3hmxg0O4KKs95E0PwLu0VBPxlpvua5wwg0H8sPceMS8p1-VBYo4Qb+shne5VPKs9nTOpqPu7nqR0lkRHPaPl2Zdxen-qJTiC++Rxi4A097AyE534bZyEeZJPzc7fK36Kn03fPa4hkCcP3EYIU2mE5qLfRFn$ZYRohwYTJK2X4rtAJJA-LnyLTrRapY$L-JYbTo7PTEB$p84QPkZ3oE3B$kwCYLZkM$q7J3zsJKP1lETRTtfJ3ppdrQ4e+rrJ-MBUG0Cx4TAf0R5ApdAe5ezPn$4Yap5-JeABrKBCPMTCrTaU9Xd$5qT3Z0TPEeTc$pfNp6DPKMo$c$fMLBlroJ7vrIc+qF39NAlp$$c$JTBrn-qBiiT7PClLN4ML2JHrG$yqHcCFKZcyTF$M3zyPkac4$-ZYVX+ptL0yPsAASoUKBNSCt$OEj$5qAUJYn$101J3QL9J4uPg-$rD-A+9bNrY+aETaEXY54Fmj5-n4nxmKbcJUKkvpeC$E$LQZUY3JYeKpPq6IpgXJe4U4AnYvMaeXgnaAtB4-ZUe+4yTeEG4uj0pArPu$RrYppRACKR9Er+e202c30QsrMoCqJ2q3tnGcCMrK1nB0pfQYNklPLef+Xq0v+eq$4LTgCvKu1Jra1$-Tt$InQKKbryUI3BfkwN4uXTZZIaxAm5KPovnZJEb3$53625b2yP-Ur5aqx3Cn2yrJrBBQpxqArJoAGef-Rpk+NXr5n$eq7ZplyRzjhAyrecNPuBnveknZTHY2$+PJGNT9or+7NkQ9TGJUbXrS78+4hpd+QH-$S0hwQMaCRwTueBA+qEqdpLYE3$mPV4Jp52Z7odwe$j3DpLkNiw4EUh4Bc7$U7TPb3Y55n+BLr+MJzez2BpcqRLUKZ6mdAzBl-Kdal93-OAl6d+$7EInIeaq+qbxZhNIn0-Nqz$YbKmrJ9g7cSAB8BClEVJY-7$5v+a-3Rv9hAfYz3Ot91r-bRTU+e6+06pEpTsPlpseAcKMjErPo-aKPLniX0gPgaaqMF3oX+YHLqoV$n-aEknmFEIUe72cortQ9ETmAFxdFoByclor--Qq4-P-YY9+PzU25clYc9ajr9GPsSMdRnaKEcLqBGYw3nqJe-r7soopc+RmTyPjJUEgagPQL44T4k-ETUCuY7C0$kX6D5wlK0jeIrnAY$drboEUhclubksbAr-NlGHl+T8PVLEPYOp5oy-RDM-cHnsisjU-sobFqf49$BTVcOEmPFxCGCIo7IgPT+AG3nJ1ls$5UFruPmPGr9qp0YdaSa5q5XPaBUPx-z4SqPPrkE-lYT-0wrXwjpe0--n2IdkkofmBrrer3Kq$dwn0MBDc3hKYZcPCaI4V-jFnolSX9YDENcA4J-Z247kjfrw7xI3L76+R1Flr6q3F9jBNsSdgqrpZ0fEEcPDEGkZVnpT7agT43+OrmUBZfEb1fPO0hUuI0lPAL57YqyNZ$7TEQ0YhVjZpI3EKY5eHJXYRGa4TR4Y-xw6Bk+nmKVBPoZPx2ckJLeR45BKYBpXwrZQd$9DJ3T+Y-TvTRRmeakH2OurvfBo8oiJTZZpFr4AT9u67rMZQhr9SUMeJyi2wenJ+$T3$f7kwAc+BU3wIeBAZPVcK2UaXRrD7M-CF6DJFeaDJbXY4GLU9yly$Bqnk6kxtqdTE3sCQ-LqT2RAcAwxAV-jPX3TInqtawwY33nzT4TJU3qwqA0t+4xP5U9Pzo6293r5E8EckwJIMFt42Ty-Gxpk6stQ9s-8P$yl354sIZUwSqRJQfEU$IJnXdcFCR+6-KvaJeG3aExvVPKbR+Uo7HYEkYcnHNdUiPyyYo4PRHCQn5EdPsuNfVo4elJXp1IPEq0pR+rEPjfal5cJFrvoAcesmstCbS+DG5YY0jLTUt9NxEj7212+TCQDGellmS1M-b-+9avGVAE2Iszs6REin$cG1IF8GiQ+9Aa3lUKFvYK9EDGtceP5l3+$jZIRMA61K4tZaQJFGAajYhZ0Hy4eVvZc9YPJKlGH+sEAvS1X-3fPwTtGoBXPmP8c8brKlwyuE9Fpg0DTtXMmI1aj0xa8KvXMmLp-n0+yI98k6P71U35ca2nOYlcjbVSU34UrNGsP-Rf05eRuROkMSe7-rlQUiPHl-J$1FrHSeVKvks30J-d5cYpre$hvRPj1KEQ9KvGavZS9FicPGGz7hc$EFSxE6qEZwOcMRY+d$bs4Ge1cdRGhN5dovfquAhBAfa3CSTCvGcSgw-AEGHCPQwR0x9FcUIgeBQpk6RBUcf4P0wdi1lBBUxlKdZtXqv7Po2o3i3hP10b43SUDEdJeOaUJSEjSs7o6Zb$nJC1hkB5C5GqQxUNB+F7G9-xF0fPPR7rD7bHRIUCJi-mc5Cnw8S0ycnRj+BaF-xSQEJ3RqSsa6beHG2ZkMrcI7oBlovKcOYLLwaLkyRI1v7-ksM0F+EsQ3Jh-5LMdbsNFPtqP1SBiUnHUqdDqxX$-N5dqEhcLbRr3Uyy0hLCLd771cI5DRP7FQODS1m9Y1RPq6d6JUxI+ofJVY2cDJJBRUDEQ-QbimZf1DkBdV-3DoNZHYPYX1zE$d0ZZmX9LhbAjNdQCq$X1ER5d8asPuZS1RP+pTBrS-gAS1uF41afei-+JlXxxFR9VKvk-UUP$Lpl9Krs6APOXCutdi3yEd$AZXbd5cT3TUPYcC1DkCRt-zr-zeRgLJxMBTapRkZ6-5lrwVbEGrEwJB2holaqsFG2Zq0AJg4nfK4P4iIb+aYlrtvtXeq4sUV5caEGfU+ilgpFtC9b9Mr1AEbg2qcTqzgRwiHJ3guMTB8EE$vlX92SLZSnw-QTau8Fd1FBlqw5AYASxjwt7Rw$Y$KgnYFB6qz54C3ybMNruQsRDlni$-kJSdd6sel5Juyyx87Q4p3bdiJ3nBwyemKfcGinbTvPmJMYp4$$P-5nYRadCSQYD-m5q4y5eQTuccybrsqqCn8se0PKb$xHf6M8QlgvaqU6h-49CvXyijX+qI5oQ+N07v4166kzFxdol2E8Pb6ipsJxwU1i+mD68c9dy1dcxQBL5+z6QZZ0uv6mj68uFIKikNiTuiFDgsCs9LeZnmYMMadGy9Q7Jbm-MradCscr9ZRukSmhJhylk0q9um-A5bqX$9lZguUx2X4O+NdRigmy+aO9Ylj0FPk0lUqm5V+pdNii1MMGmuSsN08v3w-jtD3OK0E8comUx8dUhyzQ-JHmUxSEtCsIQ-J1mknGEB4y-jVk4RBngE0CJ3fpJQmJcvEdGyq0JxIugr2mY6zZdNxLRkU7u53y9eFNnmmrjzbAikIlx5ps$Az5qioQsJam$xi$0mmwQIkER51YBo684d9xgN$3rA6CsuQLJtxenhAtAiBfJZJuvnXA55iMcJNf1UxiAopz9nJiDRsdItd7PkqkIENNppTBbcsQycyNJG$NEaoid7ZlRNLiTtwzPfwI8R6r-etwz-u4I8RUn$v54y3f5Io+4n1vF4h-fni4XuGGqRkyQ9ViOYYdlm9cKrmYIUXRxsythzc0aIJ-Zx7z52zlkfI2zLcMDAXpy$IJDyUx8Zdv4+joZ$XdMiZB6zC0eZXNNxMiAo4GuyiMzadiy55hCQHZ2sin7u5mhJfIZdXKBjbu3TddDICXo4NiQsh6jlJ2m6dmw67AsrVUDuU-KUR+N8RZIt+QYORPYxy7gbGPyrS4NBnM3HI5FYG8BEhE5T2eJ3I6kq$P9oEuPl-aLhNQ1Q8nHBb-dRVB+D44E9DIffpOXLNYZew4Hhq383VbEj68L0zS6lHIraeQEE9zcYfo3$ZH6SifuMB9qPsX4r3PPPDEesME5clY3pSR4Srzl8zi3BpRS+-e0e6Yl-dUtLCGrQLdEDsoqCl3B-4ey$yJf6-PPLiEEqSP3kY-U5THPOY0-CFz6RrwhRnpD4FBdhNAP8PB$6kLxoBejPLMM7shOPN-TfrBEftPPr$rEK-PPXKvsX2SPfUIut+KBRBPB3atT-sPJL$RjtP7tnCzQAismmGHxEp-tl3L9bfl$mtPPIlbmGH448hmBP98bf6qBP6Pu2CizmjsHO26+n-Eexqrl$+Pyw6PCvyk3vPTYxqT9tP9TjxMTtj14-4KrUoy-BDHPFUVp95fEET+Cmt+YBPPr2zYuYAZyBTnEPu5wn86q9i2TEFPXka83rshed-kmTPa-+jswE3ArrkwPM3qJ24J$i36JdOaHv+A33HYHw-JKMloPx$Bqz5hUE5P$PPsgu0qVmd0+lpaPZykFgFywlxem72qI6e9ow96EnqXDKlt4EPdzPwHdPeEbU9s46m33ix$qLqN6EhrKM-alr624l8efh$wD3k5PCvh3TYEYPdPLPa-4--HHnbhn5xY1ry9y$q0DCS6A5JyR33qLa1YkdAZUEf-Q-80YqJqT3NzHSP7k8-CKezE2nKuR0B-O-TzPormuC2Nn5qKoPPEULVt-L-$l6ofz+R9VzjAmBMjD9gO96qP7mf-0B4-97ZFPPrgc$pPP"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\npriority: u=3,i=?0\r\ncf-ray: 9c32ea8fb89456a5-OSL\r\ncf-chl-out-s: XDltwx14XFHX64/3OelVYQ==$bHEqnSr2tAJPUM51lhScnw==\r\nset-cookie: cf_clearance=A2eFNSiUAAQQmDstDjy0vZpogms.vJqQSLG02OhXHHE-1769293207-1.2.1.1-I4n.EmVXEp2n55jEBLekUA_GeSIdLVg6XDAPDtu.tMv7LAr47cW56vkUOgGCzkpX.vw7CpLZNtsOvFXWLnHzgoyapQYVMlpY2zukd9c4KXnr1VsP.bK85apWuhU8_ZCjC0s1y_1j_IYIlDbrdnVRIrDhplzDptpwgymWJv653zwLMN2S.75o.Wzd6vcWhPtZSMwghnPDNJzDaD9Cv_ZDU6YaPpuB8xwBRaf7FQCgM3U; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=moonbird.run; Expires=Sun, 24 Jan 2027 22:20:07 GMT\r\ntiming-allow-origin: https://moonbird.run\r\ncontent-length: 0\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=LWeOzMq7%2F55xs5X%2FnE9oQVddOtdmnJcEJpems%2BcgnurWOG8pRD1MbWdd%2Fm8E6hBb188P2pCcFr3PtIxxFrKjx9xv%2FJ7tOLKRdckuE5flljjAHb8pjpInUlIGwSTiL0g%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=1661\u0026min_rtt=0\u0026rtt_var=1116\u0026sent=167\u0026recv=62\u0026lost=0\u0026retrans=1\u0026sent_bytes=138373\u0026recv_bytes=21001\u0026delivery_rate=20555566\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=25732\u0026unsent_bytes=0\u0026cid=1d31f9c2140adf82\u0026ts=1307\u0026inflight_dur=137\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T03:30:24.02313Z","times_seen":17701712,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/favicon.svg","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:07.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nCookie: cf_clearance=A2eFNSiUAAQQmDstDjy0vZpogms.vJqQSLG02OhXHHE-1769293207-1.2.1.1-I4n.EmVXEp2n55jEBLekUA_GeSIdLVg6XDAPDtu.tMv7LAr47cW56vkUOgGCzkpX.vw7CpLZNtsOvFXWLnHzgoyapQYVMlpY2zukd9c4KXnr1VsP.bK85apWuhU8_ZCjC0s1y_1j_IYIlDbrdnVRIrDhplzDptpwgymWJv653zwLMN2S.75o.Wzd6vcWhPtZSMwghnPDNJzDaD9Cv_ZDU6YaPpuB8xwBRaf7FQCgM3U\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693a2b60-67e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t%2BSXRTXQPtFgrDL5KWX%2BA%2B6pLtpXgdJYxMq0msRfJ2%2Fftjr11SM%2FXxZ8%2BohbhMOlSka66y6wqUpTLS9Wm7M207a8jriZqgW1Qrg%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea91b8b756a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1662,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fc61ff6bb55192aeb3e612e1943564d3","sha1":"d672b380fef90efc07f09930398512d2c5280fb7","sha256":"94c0288efb386d7d6fa1fa4433e99d1524828d41700a4f8839a4c50faa340642","sha512":"67fcae44b255f80c91c7fbcf742119952e89b266c058828184a5685e90ab9ff0cef199d3a56550f471b19963d5ebd9f1bb72fa301a421f9ec5269b605acc224f","ssdeep":"","tlshash":"4a317486b6e939f2e605d384d202887971ea30a72f48d82683a06f94902744e598c9d0","first_seen":"2025-06-30T18:41:55.104661Z","last_seen":"2026-04-05T20:12:35.149285Z","times_seen":4,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/animate-js-1.19.1.min.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /animate-js-1.19.1.min.js HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\nlast-modified: Sat, 13 Dec 2025 05:35:38 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693cfb2a-1683b\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fcjl%2BNtp59YOxxmK5mj2JAw0FCgXpUubKG0VKlKJv%2FsAFTLy4z%2BH3WG7KkJlva6CkjYP8HijVy1nG1T7FcNnhwrc4H6xgO6vp4E%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea891ff756a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92219,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5294d4eb39dae48015394e87325b1029","sha1":"7b234b15c0f23bc8c1aae41a23f89bca2b962e59","sha256":"81e56777f84fe4c084be67070cfa4cab9f4e07dc27bc0e79606e93625d257f08","sha512":"ac7b524b1a7658bf9a261566bae17ddb4d68cd9e8d112df66355c11baa027dcdea717c2aa2ccb98803c25c89cd9f810d185237f0cbeb3b42a27c7ed6e5732828","ssdeep":"768:Eb7jQ3cOQqJ/2J/7jaYncR6SkLD4tTsNBuKq8mdHcncOtY+cvEcBpLTOV2eMinL+:ESE9jr58tKrmdOeDiCcXmGqD/h","tlshash":"099371d5991bd0d58e5220ded433e809e4280a63cdadf2a3ba6cddc1785df62c48763b","first_seen":"2026-01-24T13:59:44.524516Z","last_seen":"2026-01-24T22:20:30.229865Z","times_seen":2,"resource_available":true,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/6814.bmp","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /6814.bmp HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/bmp\r\ncontent-length: 5430\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\netag: \"1536-645a3d85b4913\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8hQj1GxzCeKlKWkUD6XTfUJsWUId6MzoBnrSAAX3tZjByk8WPvJyaxuPa9ZUwKZE8YO8tnBgDY1YOBdUPs5flSwJbnAauKmAGGA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8dd86956a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/bmp","magic":"PC bitmap, Windows 3.x format, 42 x 42 x 24, resolution 1 x 1 px/m, cbSize 5430, bits offset 54","md5":"8ae11bd62f1b36a674d44720ef75b28a","sha1":"464457cc50e9eeec6830881486c221b4e8a68ca7","sha256":"6cdf03e7fd194facf2246dff5e65146d2804c6406b3e991410725ed3b5d255a8","sha512":"a9ef752a533f710f3c60769f0272a50c10b30539aef06adf3ad322c8fffd740b013cb76084dd9f0cb43725a73b19af675b45b947342dbc5cbb4dc48115d67ff8","ssdeep":"96:khVThvpy2sS7tidUXSeTCwAQGwlEk4hUA3333333333333333n:khVThvpy2sS7tidUXSeTCwA9AEk4SA3X","tlshash":"5bb10631cb07f5a6f12a56b91b5f6f0a5065f29d4cc418d3ac82b29006cfc25f9e68f6","first_seen":"2026-01-24T13:59:44.509727Z","last_seen":"2026-01-24T22:20:30.232601Z","times_seen":2,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":324,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/3706.bmp","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /3706.bmp HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/bmp\r\ncontent-length: 5430\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\netag: \"1536-645a3d85b1263\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T5l34f%2BPhFfD8S4ayDRhAYLaYdeJIijum6UzhFF3s%2FzxzyLT5hvIFevHvzOxdfA5P7YcwlTsbcVLsfnOhaBR5daShS7%2BIrfyUQE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8de86b56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/bmp","magic":"PC bitmap, Windows 3.x format, 42 x 42 x 24, resolution 1 x 1 px/m, cbSize 5430, bits offset 54","md5":"b9a43c5fdaf9134ca3ac373ee02b541a","sha1":"6f3e47421bf1aa0abc5329fff8f94434c3ba7421","sha256":"531a1945fc270119d5543e3a6c00e2705e8b6bb049b605adf28f53ac7914023e","sha512":"fe363d59d840d51ad6fb87c9951e12143d5534bcf03dd6e1a26cae4d37c18e6dc476393a3263f9fa2bbf9365eb9fd6c0465f3f2d12aecd23b398709e44abc34b","ssdeep":"96:1ooooo6ZJClnV4Tfr+Ac6IvxzJ9PaBRcPeinX333333333333n:1ooooo6ZJClV4Tfr+Acrvxt9PeRcPeiX","tlshash":"efb13578d306f749a56517b90b8f9b892922f28f98d15dcb7894f2c913ebd51b0f0930","first_seen":"2026-01-24T13:59:44.510708Z","last_seen":"2026-01-24T22:20:30.235211Z","times_seen":2,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/649.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /649.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 76824\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-12c18\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BawkgchO%2FD%2BBJzjPGsOM%2Fve5FJSEhB%2BQFX%2FH%2FQR3X3YyZH3UcqeVTX3LBytHVRlcME78q7LhPXWwuZvJ0pWfFGH1MWr7DZjd%2Fig%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df87056a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76824,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 1280, 8-bit colormap, non-interlaced","md5":"2ad6e37d3128114e647919ebd2d3bd5a","sha1":"032d63bde216db55f8fcb08807253daa20a29d90","sha256":"7d0e7d4236811dc766b98a43d0eb33055be53548cb33a5fe74b3b5cf7f8a6b9e","sha512":"54ccae020b2587222d8ffa8408eb619178d1232ba77f9250b05bd4f05487d1dfc5c9b39e12a7e80f5b249e89b9509efeae63282b038f07050097c000d7d5f7f8","ssdeep":"1536:pP3SBCn3KbdMCMgr34XhYsiv6baAV0DoHGBFcYIp6/F:pfSBCn3uVMgr34R/1d0cHGBFj1","tlshash":"8e73025cf1e7c06b9fdfd2d5b68fe698ab66733450b07449c1aa15980d212be8e2330d","first_seen":"2026-01-24T13:59:44.5075Z","last_seen":"2026-01-24T22:20:30.238215Z","times_seen":2,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js? HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=VW5LjFqrZsDOel%2BIjv6N3qLhoJ0%2FftH30Rshn7%2Bjyf2Ssj06jULhdny5tgXdEi%2B0Kbh%2F4v6yB5%2FhJ27BYA%2FbILljOJviX9HSN3niodKcBmmnIBOiu3njSgiRowBIklA%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncf-ray: 9c32ea8e987f56a5-OSL\r\nserver: cloudflare\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=1637\u0026min_rtt=0\u0026rtt_var=950\u0026sent=94\u0026recv=48\u0026lost=0\u0026retrans=1\u0026sent_bytes=68412\u0026recv_bytes=7905\u0026delivery_rate=7736616\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=25732\u0026unsent_bytes=0\u0026cid=1d31f9c2140adf82\u0026ts=1117\u0026inflight_dur=125\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19070,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19070), with no line terminators","md5":"97816f25fbfc43e1627469fccf7c8814","sha1":"3a3c729e6a660e7454c354448b0c3f4f8911b023","sha256":"19f10988118766991a409ab32e7947946321bcb04427089734f62de9fbd57d19","sha512":"ee34696419d3182e94161a0d0c4ad4b55fa2b048dd14179e08ece2b03065e843997c2890f3990a534f8c49c2b6ae202496507518bc65d00cab490bf1e2cc298b","ssdeep":"384:qRoz9jDdTpSozlD1EJgRy45feYK6EXmnjZn:qRkFNzlD1Ooy45flg2nx","tlshash":"018289c93ceab55427be78a8046f31ffa3aa6e5270450f15c220dcd0bda0719976bf58","first_seen":"2026-01-24T21:38:17.881372Z","last_seen":"2026-01-24T22:20:30.240191Z","times_seen":7,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/secureproxy.php?e=jscdn/getFile","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:07.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"POST /secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://moonbird.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://moonbird.run\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=A2eFNSiUAAQQmDstDjy0vZpogms.vJqQSLG02OhXHHE-1769293207-1.2.1.1-I4n.EmVXEp2n55jEBLekUA_GeSIdLVg6XDAPDtu.tMv7LAr47cW56vkUOgGCzkpX.vw7CpLZNtsOvFXWLnHzgoyapQYVMlpY2zukd9c4KXnr1VsP.bK85apWuhU8_ZCjC0s1y_1j_IYIlDbrdnVRIrDhplzDptpwgymWJv653zwLMN2S.75o.Wzd6vcWhPtZSMwghnPDNJzDaD9Cv_ZDU6YaPpuB8xwBRaf7FQCgM3U\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"hn6ywu7fxc2r7yse7yyt\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:08 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LONTCZU8916pS%2F6Av7wKFK0VwUeWy26x7iXYTMk4isvQ2kFdRsUZnUAUZOkN5ExACKqKGDPLB6vYtpqgV8gMkHJ6l4Lxi7yDYQY%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: PHP/8.3.17\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c32ea91c8b856a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5f2dcc314f77c834f8a1dc091e77a698","sha1":"02ddc9e3c5026f1aeafa9098cb1ee9420a53e0f6","sha256":"ce58bf87319ddd62d94026ba708b11b1acdae99d417ad71e78385c5c48baeffd","sha512":"e5ffa46481a71e28bd2f56255d4e66e025bdc281820203e1f2e2cf92c43df8d5bab7824acf0942b788c184e7fcba92bed561ce9c6b96a30c508c89a6a6665437","ssdeep":"","tlshash":"3980000e0282020f0022a8b08ae82c300a8a038008228e280008a0080e2b0828c000cc","first_seen":"2025-12-12T04:00:11.329317Z","last_seen":"2026-06-27T10:14:25.971626Z","times_seen":46,"resource_available":false,"data":null}},"time_used":1066,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1066,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Sat, 24 Jan 2026 23:08:05 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Alnnd9o9P2i%2FHK35G8bsIMEUuf7OIfL26AiBMGPXWaTZqiUZd8s4%2FRGTmvRz%2BzlOfGK8XE%2Ft0KEcLl6yn26OK0SSAEAIqZo5ZJE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:05 GMT\r\ncf-ray: 9c32ea891ff856a5-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-04T03:31:00.118866Z","times_seen":414114,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/febb533536c81344870d2b82f2f267a317e516ce.svg","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /febb533536c81344870d2b82f2f267a317e516ce.svg HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693a2b60-3e2c0\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ALoRPN9bMo8P7VlF0mXru7FGVH9RnCQRX7%2FkXCVcvgdWnSB%2Fz8doO88BFDDDDQelmI1PqI4VoVQHR4UGoqVVzyMVEUsHZ6is7JQ%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea891ffb56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":254656,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"871a19ecc3a29c9ea1b899bbc81dcf43","sha1":"febb533536c81344870d2b82f2f267a317e516ce","sha256":"2a22de59612ee41ae0fc1a627a859ca5ade3c1e6e212ea0a02d0888772a71ab2","sha512":"3e1a91c293e67b897ac323e1345e85e1092ecd6af6d5d88fe1f8de86a970014ec3e29a06fbf858f66fb917efdd2ca57334f8859eea9db4a41cb941f4709caa6c","ssdeep":"768:7pV+tXqHb8cNqWBDxMNiNokRVBPF9uwKuugglqge4HjWml9Vo1N2OCmwkkZsGJNE:Nb8cNqWBDxMNiNb","tlshash":"ca446d38c068f4d85229563da3a4dedf2403a75b6728ea4d4748a127fd0bc705a3d7be","first_seen":"2026-01-24T13:59:44.520508Z","last_seen":"2026-01-24T22:20:30.243714Z","times_seen":2,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":314,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/OG-1.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /OG-1.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: image/png\r\ncontent-length: 7994\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-1f3a\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NWQAfKAKXMEBHF88FMHWVck4LA4pWy6Me7ldTE3x4I1fTfST3qs3mVVvDZpEzGQq9zpYWYG98Tj4vGFHphIGIccJE%2F6g1%2Fma228%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df87156a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7994,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 640 x 640, 8-bit colormap, non-interlaced","md5":"bf052d98015d166e7aab3027b6da2ab9","sha1":"9ea3f45d88832a041dad45b17f9d646084b819cb","sha256":"ffbe795ecfea6cea90928a9ff37404bf5da4ddcf4a6e4df9230aca3ef707f536","sha512":"3d7d4bb0ed3c3cb444ad652b4d8fae8aef6dd29c582a75332af2ae7b8651da378e2387d12528592734374dd84ae9144e646ef79bf60ca61177f34a996cf50531","ssdeep":"192:BchS/2krEEzl7rQQr+dOyyCfd8AOqQurNR7EUCxwFg1oRbcDSNBg8vX:+I/5rLzl7rD+deCfaYQu7JFgqcOQU","tlshash":"7bf19fb613803a2aa1f1d53865286ca9294c273edb520b5c6189d7b51c6030fd23b373","first_seen":"2026-01-24T13:59:44.515733Z","last_seen":"2026-01-24T22:20:30.246245Z","times_seen":2,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.proof.xyz/favicon.png","fqdn":"www.proof.xyz","domain":"proof.xyz","tld":"xyz"},"ip":{"addr":"172.67.174.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:07.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"proof.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 03:29:28 GMT","end":"Wed, 01 Apr 2026 04:27:50 GMT"},"fingerprint":{"sha1":"7B:93:44:E6:10:47:15:A7:D6:C4:09:7D:0B:E7:23:94:0B:DE:FA:20","sha256":"5D:3D:A5:B8:E7:57:82:E8:CD:66:D8:09:F9:DF:7E:73:1E:DA:45:02:20:C4:12:10:81:D1:31:B2:61:78:0E:A8"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: www.proof.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 1640\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 24923\r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-disposition: inline; filename=\"favicon.png\"\r\ncontent-security-policy: default-src 'self'  cdn.infiniteobjects.com fonts.gstatic.com; frame-src 'self' ipfs.io arweave.net *.arweave.net generator.artblocks.io generator-staging-goerli.artblocks.io generator-staging-sepolia.artblocks.io www.youtube.com www.youtube-nocookie.com verify.walletconnect.com proofxyz.mypinata.cloud *.crossmint.com; connect-src 'self' wss: nft-metadata.proof.art *.ingest.sentry.io wss://*.infura.io wss://*.walletlink.org wss://mainnet.era.zksync.io/ws virtual.mainnet.rpc.tenderly.co wss://*.bridge.walletconnect.org registry.walletconnect.com wss://*.walletconnect.com *.walletconnect.com cloudflare-eth.com *.wallet.coinbase.com api.wallet.coinbase.com mainnet-infura.wallet.coinbase.com *.algolia.net *.algolianet.com generator.artblocks.io generator-staging-goerli.artblocks.io generator-staging-sepolia.artblocks.io media-proxy-staging.artblocks.io www.googletagmanager.com www.google-analytics.com storage.googleapis.com birdwatching.moonbirds.xyz *.infura.io *.g.alchemy.com *.alchemyapi.io *.infiniteobjects.com *.sandbox.infiniteobjects.com *.myshopify.com graphql.contentful.com goerli---entropyserver-prod-r6hwrvi3xa-uc.a.run.app mainnet---entropyserver-prod-r6hwrvi3xa-uc.a.run.app api.proof.xyz api.proofof.dev birdwatching.moonbirds.xyz api.proof.xyz *.mux.com inferred.litix.io ipfs.io studio.plasmic.app cdn.contentful.com *.crossmint.com arweave.net *.arweave.net; script-src 'self' 'unsafe-eval' www.googletagmanager.com 'unsafe-inline' *.infiniteobjects.com *.sandbox.infiniteobjects.com studio.plasmic.app; script-src-elem 'self' www.googletagmanager.com 'unsafe-inline' *.infiniteobjects.com *.sandbox.infiniteobjects.com studio.plasmic.app codegen.plasmic.app cdnjs.cloudflare.com/ajax/libs/p5.js/1.0.0/p5.min.js cdnjs.cloudflare.com/ajax/libs/babylonjs/5.0.0/babylon.js; style-src 'self' 'unsafe-inline' cdn.infiniteobjects.com fonts.googleapis.com studio.plasmic.app; img-src 'self' data: *.proof.xyz pbs.twimg.com live---metadata-5covpqijaa-uc.a.run.app lh3.googleusercontent.com cdn.infiniteobjects.com *.walletconnect.com www.googletagmanager.com cdn.discordapp.com proof-nft-image.imgix.net proof-nft-image-dev.imgix.net proof-xyz.imgix.net moonbirds.imgix.net moonbirds-oddities.imgix.net proof-collective.imgix.net lunar-society.imgix.net mythics-assets.imgix.net mythics-purchase.imgix.net mythics-purchase-dev.imgix.net images.ctfassets.net downloads.ctfassets.net *.mux.com i.ytimg.com placehold.co storage.googleapis.com studio.plasmic.app img.plasmic.app site-assets.plasmic.app www.crossmint.io www.crossmint.com arweave.net *.arweave.net moonbirds-image.proof.xyz collection-assets.proof.xyz; media-src 'self' data: cdn.infiniteobjects.com storage.googleapis.com proof-nft-image.imgix.net proof-nft-image-dev.imgix.net proof-xyz.imgix.net moonbirds.imgix.net moonbirds-oddities.imgix.net proof-collective.imgix.net lunar-society.imgix.net mythics-assets.imgix.net mythics-purchase.imgix.net mythics-purchase-dev.imgix.net proof.infura-ipfs.io assets.ctfassets.net videos.ctfassets.net *.mux.com blob: arweave.net *.arweave.net; worker-src 'self' blob:; form-action 'self'; frame-ancestors studio.plasmic.app\r\netag: \"85ac87e30c6a516ed80e6c4ae1fe12c7\"\r\nlast-modified: Sat, 24 Jan 2026 07:03:53 GMT\r\nreferrer-policy: origin\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31104000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-frame-options: deny\r\nx-matched-path: /favicon.png\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::hfhcg-1769263157106-ceabcc255e07\r\nx-xss-protection: 1\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gHls95bCg2M7S%2BcQcPFSyxR%2B9NpLFIDRnk0nOORL9TaMXNfeOTKCFXGL5tCRInqYHul%2B7NTdOqEhLEryp9OEVeaVFUWYiV8DCGC6\"}]}\r\ncf-ray: 9c32ea9208a3569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Algolia","description":"Algolia offers a hosted web search product delivering real-time results.","website":"https://www.algolia.com","common_platform_enumeration":"","icon":"Algolia.svg","categories":["Search engines"]}],"data":{"size":1640,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"85ac87e30c6a516ed80e6c4ae1fe12c7","sha1":"d54382763da00be689a8b63e98b33682fdab82cf","sha256":"8efa9a466610edd68e3f7d358e91d717ef914dcf25e724bd3acf4630c9b389fa","sha512":"62c23a30df1314f44ac925c97a802c911f750385307e109ef2a0c96f1d8fbe608e5c6d5080e0f0d36a6910eb43989369de750438b7e0f7f25c8c29929a1f1425","ssdeep":"","tlshash":"2a31eaf43f63c4bfcd1e8c7d8d69501226e68cbd3d8e9953ae005312da2078619683b7","first_seen":"2025-06-30T18:41:55.134208Z","last_seen":"2026-04-05T20:12:35.148289Z","times_seen":4,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":31,"connect":1,"send":0,"wait":89,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/0727da0c1420e8e0.css","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /0727da0c1420e8e0.css HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:05 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693a2b60-21e7e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uXFW%2BjEfQKAcZ61A4h1FESKGKBSAlDP1qQlDrKPqhUsBcOfwomPqfTJ3mUNf9eHBgeWzDXkRxmW6F7TDxOwAy2lz6GpL7MT6w3A%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea890ff656a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":138878,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"2a55921f4e9035f85debfb89ecd89814","sha1":"79de6ce18237518ab2e048460a31c1b1a591729f","sha256":"9ea04128300d85b9c645a01c571c1beadb9d84b6bd9494768f4f99beb8b59131","sha512":"99e738b804a0b81da27b2f0ba9e020d56b22a4592190cbb704a0c6abd01a8b76ba37e89fd03ea35ea4b3d155b7f8ed2d8cdaa9f97fcabcdb3e5983166f24196f","ssdeep":"3072:ojvifJ+VL+bOv4l3sUZf2D9ViswPRPPA9:YvifJ+B+bOwl3sUZf2D9ViswPRPPA9","tlshash":"5ad3b7ede984553a3d17957b92ecdaecf305e881cf225bd6bb92804405c2bf312d624b","first_seen":"2026-01-24T13:59:44.517136Z","last_seen":"2026-01-24T22:20:30.248276Z","times_seen":2,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/f9fa0444b908def7e2cacce9c162c39a60167a27.svg","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /f9fa0444b908def7e2cacce9c162c39a60167a27.svg HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693a2b60-1a6\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e3x4KI62NQkufdfj02Q%2Fx1uQ2WgvR%2FHH4l33JCFvR%2BOBE2P1H0vVpxb8v9GYovPrNWzF3OCQtCrA2OLTaUpsO%2F0Is%2Ffb3ndj340%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea891ffa56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":422,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9e47aa80842b4d43a41898ac56baa984","sha1":"f9fa0444b908def7e2cacce9c162c39a60167a27","sha256":"e94f4ec3d5f854f7281c9c36eeff5313fe0b739a16c7f2b6336eea87f1c013d3","sha512":"be8707bd09706a2691cd3f855f1fdd9f5bc3c4b49c87c876b7da2dc97b611ef52ced2b5290afdc1bd9efd378e42d60daf38deca85f0c955a228dbb2f27daedd1","ssdeep":"","tlshash":"6ee02395523ed45d6403d94dfe2934d15856b1e9b3084ff9e354533c9cd09ff3441164","first_seen":"2023-06-14T18:42:25Z","last_seen":"2026-08-02T06:27:33.2485Z","times_seen":362,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/6790-1.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /6790-1.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 55736\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-d9b8\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q6tbGbRIAynkIvimNRps5wllztI1pfACyW05XWGCehv27Db1K0UdOLv1UBR4iaU8fRSOjhwsxfEMoGHblNVesrej1Uhan9RjYy4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df86c56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":55736,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 1280, 8-bit colormap, non-interlaced","md5":"8fb35866182dccf27875116a735682ad","sha1":"d77eaad28ea908e60d725534716fb9f539ceb6af","sha256":"79605d10f885f19e103ae9fe57b636fa1f005d0c9f6b026207659892f57f40e7","sha512":"f1f3abd32d15167844ef6ae0ceb46ec1a2614821b2e76578b1bcc499496abce9e90c1ed8d49527fcaa507baa6b6cfb2186d1b01a630d9fd28e86b2bde0049f79","ssdeep":"1536:MLiTv0LEbYAtEn2oEGuhbjMtR2kRpB+W/oJkEK:mGvcf2oErhfeRpd8xK","tlshash":"9d430243624ab5ba0313f521507c23647b29f4e398b8538dc7eaa92668cf468f7c945e","first_seen":"2026-01-24T13:59:44.521485Z","last_seen":"2026-01-24T22:20:30.2501Z","times_seen":2,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=iMEXJTRL8au6rAhsPLglygUB%2FKk6gYkBFKoms5f7GYVDD%2F3bNzJERLtrzgXYQ%2FK9tFkkHAMGYCJ5j7kq0%2B8znygrKTcnYp0U2NFZP%2BCs2BWL6kQVgKpDUzF85nsrD2s%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\ncf-ray: 9c32ea8e387856a5-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\nserver: cloudflare\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\npriority: u=3,i=?0\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=1574\u0026min_rtt=0\u0026rtt_var=1099\u0026sent=92\u0026recv=46\u0026lost=0\u0026retrans=1\u0026sent_bytes=67594\u0026recv_bytes=7595\u0026delivery_rate=7736616\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=25732\u0026unsent_bytes=0\u0026cid=1d31f9c2140adf82\u0026ts=1074\u0026inflight_dur=102\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19070,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T03:30:24.02313Z","times_seen":17701712,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/c1986af3c26609b8b7d8933f99c51c1a89e9ea6b.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /c1986af3c26609b8b7d8933f99c51c1a89e9ea6b.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: image/png\r\ncontent-length: 68\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-44\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L7CNv2Daylsg%2BUGH062HLuFOuZXq4mGC6WSrVAbpEqvWaq2eyc0FVllFz1pEEca12G74ehqP5Fb44Nvs4sw0sVXnEJYORw2N%2FhI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8ca85256a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced","md5":"91e42db1c66c0b276abf6234dc50b2eb","sha1":"c1986af3c26609b8b7d8933f99c51c1a89e9ea6b","sha256":"63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058","sha512":"0b77019542fdb02f72c8407a379579bde36e2fe3af81b1c74553f1b5df2590373bf7e6ff3fefcbdaf0b9a2fcf9b1e57b30d24e29810f0cfaf9d51153415c89ce","ssdeep":"","tlshash":"bea022c223e0ec3cc38c8233c0000230f83000ab08000028202be0202e822e0088c2a2","first_seen":"2023-04-05T22:54:48Z","last_seen":"2026-08-04T02:59:05.473277Z","times_seen":35879,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/new-1.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /new-1.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 33504\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-82e0\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a%2FGmuH7Cv3%2F%2Fjbq3sG%2FMVU0ONHBzcUkf%2FTiLd0k9h%2FQP7MOmZKmz5JgZ7at7EIOmgR9K57KkvCukqcq1%2BljHhWpAg3z9lJCBHZI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df87256a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 640 x 640, 8-bit colormap, non-interlaced","md5":"c4e0de2d64509916d0585a319eef51c9","sha1":"0d87d3b17c5e0e22d2a08ea4d8f1431761f57d46","sha256":"76d0077a53678c737ba62a9436375b98a9eb403b5c1dca6632a87c53c4acf528","sha512":"a3722a80361e103aa4a6dfe39854d2faf60339d8eb6f49346255050172d41ff39e80ef83ca1bf617ef309785c81c153af4a17a4c28bf48418e899d7ce5c25a06","ssdeep":"768:rGu5aCQFgoEkf5dKdF8enuXdqKSyOweZ2zJr1yMgb/RFg:rG+ajg1kfydF8c61SyOw8O7g0","tlshash":"0fe2e11f7dd209a8109bd914e2c9f681d6b08a878e1f777bf04843780b9e22f262345b","first_seen":"2026-01-24T13:59:44.51809Z","last_seen":"2026-01-24T22:20:30.2516Z","times_seen":2,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":484,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/da39a3ee5e6b4b0d3255bfef95601890afd80709.txt","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /da39a3ee5e6b4b0d3255bfef95601890afd80709.txt HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: track\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: text/plain\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\netag: W/\"0-645a3d85b6083\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xY8f0lOKw0GdLScwc4J98DZnHe0c3ravSfadgfPxrQrRY0tRNBKIEV%2FqZOzBv6br6wyZOGKayti%2Fz5DcUvIl%2BwOKomnXauQlF7A%3D\"}]}\r\ncf-ray: 9c32ea8e487956a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T03:30:24.02313Z","times_seen":17701712,"resource_available":true,"data":null}},"time_used":535,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":535,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-24T22:20:05.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 24 Jan 2026 22:20:05 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DIVjtLnsq0rwsFh8%2FNkjr0liQdvQpk8nZw1AB4oz7sbZc0jLWhO%2B4boPimUTXtqWDO9KCr0l%2Forhbw5SJqYGpQq2sNiLqeWgiso%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9c32ea873ce77129-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":360907,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (2425)","md5":"d6d9323c750368765dadb0196fe8bd63","sha1":"20bc23687865c4f7b48076ffe64008b7a716dff7","sha256":"86865693fdc02cdaf4a00e5015939c6e7e4411522a8095d11dd3920e30a67cb7","sha512":"b0ccea1e6f27a55a7f01ff3f17e00466661d27dc28e9e937921b547b80544e04688fb52612c28138a0ec5ef3d22e3daaeb9a34edfc174123022f14edc38c9b5c","ssdeep":"1536:D8vbXsX1XinJ30J/xgcSGg5JXi4GLZWUx6Cc5zrVMk6LzVsNBJaYJIs2GJbmkJF3:oHNw60jK6ULe03fw00zmV","tlshash":"9874839c49b213ad190751a817bb12d52badc817b74bce59bdcc63588fce2a78403b7c","first_seen":"2026-01-24T22:20:30.252638Z","last_seen":"2026-01-24T22:20:30.252638Z","times_seen":1,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":42,"dns":23,"connect":1,"send":0,"wait":66,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/f0438febff768476c4bd646204034239a5fc20d9.svg","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:05.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /f0438febff768476c4bd646204034239a5fc20d9.svg HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:06 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"693a2b60-286\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Nsee7iB2%2B7PO%2Bu09SFn7Gg4AuXB4IYIll6toSxD4qBTfoGBiei8yCq4slbvuz66%2BAGgYyfolna0yBzzu2NRhlLTYOA5D%2BGUxUo%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9c32ea891ff956a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":646,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bcb0acca5ca36852531960b5d63a86be","sha1":"f0438febff768476c4bd646204034239a5fc20d9","sha256":"3bd151eb77e3cc456935eb7decbc0984759fb4d00598088fef0e3632968140ff","sha512":"757a3b9e03791be66c6a21e54115ab9a1d29f41eb23809f8512ba13d899960b3eb91bbf4b2a4779329469199f4f0b5e3571aaa24bae2b1cbc3d03da540533d9a","ssdeep":"","tlshash":"7cf07bd366684368cd06c0cfb30fa810564770c9e25a5e9b924c0b2b958fbcf34425d8","first_seen":"2023-11-14T00:56:20Z","last_seen":"2026-08-02T06:27:33.255446Z","times_seen":363,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/9060.bmp","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /9060.bmp HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/bmp\r\ncontent-length: 5430\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\netag: \"1536-645a3d85b58b3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=US%2B3kTfWwFL783GQjXfxx2Wze5iq0J6rBZ0mU0JFkKxyygGGyhyj%2FRD4Rff0Q0vFSK5Eblrro5LNN%2F6CQyKC6VJ8eTk5hrS1y04%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8dc86756a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/bmp","magic":"PC bitmap, Windows 3.x format, 42 x 42 x 24, resolution 1 x 1 px/m, cbSize 5430, bits offset 54","md5":"eb0b220c185fdf6d448d8b18abef79d9","sha1":"2c62975ad26ce6e389c9bb5c0373acfeac44d5e0","sha256":"90a3e928afd9ff10da11b6bb04a1cdc74f81e906bb83b4da76eec48ada7ed835","sha512":"9b2f61d52b03b783456e59f2a17ad708f9a46f64cb86a158ab3b76d9db427e5c29ed08d9ec22098380bb4ed25ce6d77e31f4220c9d1cd2ab20115ee456b2d4a8","ssdeep":"96:6R/Rgr64eOGtzlzwTHuQ6iHw4RUZoFh0qereBT+QFCebBBBBBBBBBBBb:cpx0","tlshash":"f2b12da1e1cc6b17600fa5335f29034de47af58acd510bb59ca9e2cb4707a01e7f4ea2","first_seen":"2026-01-24T13:59:44.513668Z","last_seen":"2026-01-24T22:20:30.254417Z","times_seen":2,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/8874.bmp","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /8874.bmp HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/bmp\r\ncontent-length: 5430\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\netag: \"1536-645a3d85b58b3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=huAfaVnRpF%2FkzPSAKHg5K8lW6OMDOKjSB1ydXT%2FlNmZmUVAcRuER%2B3UjHpLYJ5E%2BjYYe%2B7iblB1MbDqdgXjbvYWY9sfUYnOozVo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8dc86556a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/bmp","magic":"PC bitmap, Windows 3.x format, 42 x 42 x 24, resolution 1 x 1 px/m, cbSize 5430, bits offset 54","md5":"97cd5f209d41726a69c5518c48b473c9","sha1":"d068f906b9b39023789857e7e44b24b45724e1c1","sha256":"fd0ce69654c4c78446330a6e6ff36b58dfc94e4e947d750a3edd167fb9d46684","sha512":"928ca95a5fb571f3ac41cfb6c3de7e08f61df4dc3202add0acb7ef66a0d54cddf3773e95e5cfbbbe4c7a561196648d43ece90f513d52280caf300e5105f9efab","ssdeep":"96:nGGGGGiJgU0oHvc0ndIIIsVQTvOvvNvzxwRlRTjaNUHdzbbbbbbbbbbbb:nGGGGGiJh0oPc0ndIcVQT6VbKDhGS9z/","tlshash":"65b1f4fcd01ee60bc380eaf5bc1943c329855ca73d175abeae8158899276447efa3017","first_seen":"2026-01-24T13:59:44.512724Z","last_seen":"2026-01-24T22:20:30.255453Z","times_seen":2,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":426,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/7978-5.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /7978-5.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 58291\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-e3b3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F6Or7SKD318d8UB9VkSkfqIjS%2FkGtZTWaZQuj%2BrT5pCGEZmaXPICeZ%2FNZ%2F9cONukooItf7ILpHYyoDoq0FhyzBzyKx9WO607R0Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df86d56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58291,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 1280, 8-bit colormap, non-interlaced","md5":"6da7a3b0969cd1ea5344282f2b16e4a3","sha1":"fb8da739cb96bb0a805a54294b6859e87ea93174","sha256":"3f99e55a61a6602ed1ced2ab434ccc0fb4cffda5df0dca77314d485f54d33f6f","sha512":"583d7b06e549567bdf74b3f077691df7b1eb449422e350ab0456ce58d82a925f7e7d112d44e60a4538abc1836c58a2ba70de323d17f8c9ad23ade9201e1b1b70","ssdeep":"1536:Ruw727lQ4rTWy46K/y5JJ1gaYxjy0X3JrYI8E:F7276oaaDsTxjrX3ME","tlshash":"0e4302153177af16fa28cf7423359868e541722ab19dd45ac264d0bd8f0b80326f72eb","first_seen":"2026-01-24T13:59:44.525401Z","last_seen":"2026-01-24T22:20:30.256856Z","times_seen":2,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":396,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run//secureproxy.php?e=jscdn/getFile","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:08.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"POST //secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://moonbird.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://moonbird.run\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=A2eFNSiUAAQQmDstDjy0vZpogms.vJqQSLG02OhXHHE-1769293207-1.2.1.1-I4n.EmVXEp2n55jEBLekUA_GeSIdLVg6XDAPDtu.tMv7LAr47cW56vkUOgGCzkpX.vw7CpLZNtsOvFXWLnHzgoyapQYVMlpY2zukd9c4KXnr1VsP.bK85apWuhU8_ZCjC0s1y_1j_IYIlDbrdnVRIrDhplzDptpwgymWJv653zwLMN2S.75o.Wzd6vcWhPtZSMwghnPDNJzDaD9Cv_ZDU6YaPpuB8xwBRaf7FQCgM3U\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"hn6ywu7fxc2r7yse7yyt\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:08 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dL%2BFki2akFJYXsiQMOZdYIL5TScUnd9JAv%2BdsUwNv82P5%2BcYrkBoiMeBvIUZkz1rtt2Y%2FAvC1XnEbdwialjRqkELQHC56D7uXv8%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: PHP/8.3.17\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c32ea98794356a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5f2dcc314f77c834f8a1dc091e77a698","sha1":"02ddc9e3c5026f1aeafa9098cb1ee9420a53e0f6","sha256":"ce58bf87319ddd62d94026ba708b11b1acdae99d417ad71e78385c5c48baeffd","sha512":"e5ffa46481a71e28bd2f56255d4e66e025bdc281820203e1f2e2cf92c43df8d5bab7824acf0942b788c184e7fcba92bed561ce9c6b96a30c508c89a6a6665437","ssdeep":"","tlshash":"3980000e0282020f0022a8b08ae82c300a8a038008228e280008a0080e2b0828c000cc","first_seen":"2025-12-12T04:00:11.329317Z","last_seen":"2026-06-27T10:14:25.971626Z","times_seen":46,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":78,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/5528-3.png","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"GET /5528-3.png HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://moonbird.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 116571\r\nlast-modified: Thu, 11 Dec 2025 02:24:32 GMT\r\npriority: u=4,i=?0\r\netag: \"693a2b60-1c75b\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n8EM%2F52miNGG%2F1bzgPwnDwdqYT%2Bh8Fjr%2BrgP%2FpA5RBsmS0edQqtar9wKLI2wKrIzkvYMyDB2owmKlMAJ99E5%2B5PHEA5exvqPjcg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9c32ea8df86e56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":116571,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 1280, 8-bit colormap, non-interlaced","md5":"210703443c5bc5e5cce3f54785688bf3","sha1":"99b5124200d080611e3352684328d28626020bae","sha256":"8e89b1236c101be5cd4890c59180d593914f827f3784997b260186fc095de511","sha512":"3ad7ea96bb9e39b3d3fdf33385bdfcc4c8e9798d1aab77e299c6e27ece762f5d7f9aa83764e96a03891ee0c51ad2b5403e84e28cf06db1e00dd1ddc965f4f014","ssdeep":"3072:PuPBRL0ha6L3h78b74gCP8AvR/7UZTfg1zDEQFobDgOflh9Jr:GBRY86Lx78n4g+5/7UBmvtFeDg+lh9h","tlshash":"78b3122d13e5ecffcbbe38989d5499ba1b193431059f9ad4d52186be39a1826b337c00","first_seen":"2026-01-24T13:59:44.522381Z","last_seen":"2026-01-24T22:20:30.25855Z","times_seen":2,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moonbird.run/secureproxy?e=jscdn/getFile","fqdn":"moonbird.run","domain":"moonbird.run","tld":"run"},"ip":{"addr":"104.21.3.26","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://moonbird.run/","date":"2026-01-24T22:20:06.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"moonbird.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 01:37:27 GMT","end":"Wed, 11 Mar 2026 02:36:07 GMT"},"fingerprint":{"sha1":"7B:8D:AB:1D:BD:D6:96:FC:6F:F5:73:2F:62:0B:10:36:3D:7E:10:87","sha256":"39:BC:FC:81:D8:64:55:F6:95:53:5E:E9:7A:F5:00:4B:87:FC:3D:E1:36:4C:4E:11:E3:A3:86:EB:4E:BB:1E:76"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: moonbird.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://moonbird.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://moonbird.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"hn6ywu7fxc2r7yse7yyt\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 22:20:07 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j5%2BGw8oWDWtyZTpe%2Bi4LTVmbkbJbzm%2BFJVxQMOMnQtUj23b6f4yseU60muyqYjWIx4kjq81anI%2FrSsovmBbyfEMaRAsWC0ZfhOU%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c32ea8e487b56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1128,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text, with very long lines (933)","md5":"0f76f0dc78711ba7213990b40a0d0b4a","sha1":"bdab603d3b70355ed664331ee50310c614f6ddda","sha256":"f8c0fe03473b67ba9f99974f23755b338745745ada9c2f9170667e63836bbd66","sha512":"5b66ac0525ea410aebcd63c357d1e4820ac69053de444cab67a6791af39167144901f6dea8dff6e337feb03f4356c6a6dd68caa0923b08f060a051328bc84386","ssdeep":"","tlshash":"e02163bd3a169234c592018631fee7e93d3521717a0290c4d69cdc199d18e9b08dfcbe","first_seen":"2026-01-24T22:20:30.260317Z","last_seen":"2026-01-24T22:20:30.260317Z","times_seen":1,"resource_available":false,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":534,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"moonbird.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}