{"report_id":"fc39fe80-a19a-409c-b45f-ec6c434f414d","version":0,"status":"done","tags":[],"date":"2026-10-07T08:14:10Z","url":{"schema":"http","addr":"moon1.bfsx.net/","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"moon1.bfsx.net/#/","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"title":"undefined","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T02:38:36.053238Z","times_seen":19112269,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"moon1.bfsx.net/","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-11T08:14:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"moon1.bfsx.net","ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-12-27","domain_rank":0,"first_seen":"2026-10-07T08:07:09.713049Z","last_seen":"2026-10-07T08:07:09.713049Z","alert_count":20,"request_count":10,"received_data":5243369,"sent_data":4841,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":10735,"sent_data":558,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"connect.facebook.net","ip":{"addr":"157.240.200.14","port":443,"asn":32934,"as":"FACEBOOK","country":"Denmark","country_code":"DK"},"domain_registered":"2004-04-01","domain_rank":1088,"first_seen":"2012-05-22T02:51:28Z","last_seen":"2026-10-07T07:41:14.302503Z","alert_count":0,"request_count":1,"received_data":432931,"sent_data":467,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/chunk-vendors.ecd83b44.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e730937164a5e67b9e82b546afc78fb8","sha1":"4377213c7a3dd0c114ed9c064724f707215ed338","sha256":"a588fa15b404f8993c38a41da8f282d3555d748116b4ee1d71ad88c4a6434158","sha512":"963cb067eb4bdc1f333df91c2ae9d611fa7acbdc4bda3b53593524b87600b3a58a6f594ae5f3b916fef37785bc51662eba85dac418bbd6a0098155df0351ed44","ssdeep":"49152:t9ON6yG8vSEDe1lFxQegrYlHtpRB4XKS4zDs5x5+tELeobnI3UeF5lYuPeoUutbd:tI6yG86EDe1lrK3L2Z","tlshash":"fe064b8472a1b06543a711f5407f140ae335585d780d846cb6ace8ebbfbe98e563bf38","size":4005774,"data":"","first_seen":"2026-10-07T08:06:02.628756Z","last_seen":"2026-10-10T11:42:16.369945Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/index.dadc7d1f.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4c67b54053a6ce1aa4d7e13739b21eb8","sha1":"00105af759653bccfdd0ed99ee9c236ab9c64a03","sha256":"5a40bd0af4f710d84ffea757cdd6e088623078b6648156a2b79bcf23cc147aa4","sha512":"7681dae218975b36790808b94b387d77cb61f81db9b9fe60900b596681f393a6600f3161c228625298bb02f2cc11ef84dee62b4d9251ccda04da87c54501da4d","ssdeep":"6144:Ce+WbYgacEU3vM9E4uCMsfhmXBJGpqx8Z3iK0LGjD2mfc5s6gnxtb/1Ixml:McEU0i0mXB9x8Z3iK0LGXEAxtbN","tlshash":"d0a45b6a7296703247eb91d660af0002f37e5e68644c44acf3b9d4da39a4e5841fbf3d","size":485275,"data":"","first_seen":"2026-10-07T08:06:02.616448Z","last_seen":"2026-10-10T11:42:16.301799Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/5911.84f3ac49.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f59b5a07abba63548a7a099a67ed7483","sha1":"7a9b2041210842ba62bda0b47eca2315a8a1fdfe","sha256":"a58ea2d0c3431db95455f853e0416976db1b99a8a75c024dcc071e692811ad75","sha512":"c9a59ebc2d50ef4b63e55dfca1c8c342da4810220688e12eece0af760cf34873d67456176fe110393100e4efc5596adec260ae5345886ea1d552981806ca0d3f","ssdeep":"96:bOVIzUphd8IXAhc56LOCzxC4WQzzVoMyE7aCa1UkOiFYNprala4Gw:bGQW8Thc56LOCzxC4WQeNE7tIFYNprYb","tlshash":"cd22df1a11d6c0e0b3bded532376ae53eab737ba8e4d29c0e954988413f3647e17209d","size":10393,"data":"","first_seen":"2026-10-07T08:06:02.625787Z","last_seen":"2026-10-10T11:42:16.345892Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c31e7584b07711c8e56839ede034f858","sha1":"db61145a15eb1d6db06bd7d59e84b5aaf0c1ee26","sha256":"a8da70d4a710074d98ea60a86e66e94085bb1712ff4322e6a8fe36aeb395caea","sha512":"907b9030800e9568be4ed568bb02a97d2c57c92c5390329fa142382fa86aefdf5e012af1460b5ca56402cb5f71a1abf0f8d96a8da9a7f39b3b4f6b9e1d8ff0cb","ssdeep":"","tlshash":"f9f0ab9f2c43a02633e92239c727a66b2762070128c2d919ba0dc8142fe0896189299e","size":438,"data":"","first_seen":"2025-07-05T03:06:36.36666Z","last_seen":"2026-10-10T11:42:16.362857Z","times_seen":122,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/lang-index.65952107.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e57f7c68a461d4e8c32516f1a0c6bf2a","sha1":"ae7116e0e5698e2ebed1e360e7f9c27d724c4f3a","sha256":"2129add0a7a404f82d6e095b9e8d4d7313bdcc636a007a54dbb2711bb7f2ce48","sha512":"39778fc3842e6c3197b3db5400bc41a04ef9103d899251fa6eb325e4e4a18cf3b04ae24ab52cbfb52e56df25f3816f58fce40baac9d576ec73164e72eb8729d3","ssdeep":"6144:bztDGv8hWpsAeB/9zTqQD4Wf5CsWnfKdMCIElgb1AhgubpdPa0uht+gOZ9AW5yJh:bJaEhW4DnbgObcADEhkL6","tlshash":"3cb49e9cf7d1653ba2981be3bae3e04bd207245e844546628d93f7c44db472ce9e2e31","size":530352,"data":"","first_seen":"2026-10-07T08:06:02.621325Z","last_seen":"2026-10-10T11:42:16.359126Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/en_US/fbevents.js","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"157.240.200.14","port":443,"asn":32934,"as":"FACEBOOK","country":"Denmark","country_code":"DK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b43439b97b3b28c8e8120e9ae25eae5c","sha1":"e6349d730bb26b4bd4a485cf72b09d7b114f95b9","sha256":"cbdf0712673ad94781b25c743f49d8d6135f59d76ec1c9e060b4b2e259aeb28d","sha512":"d233ffa0baebb730c6ba4789cd6810c37a1cc7334fca9b2d0efb50781a92a007e3023988557012dab48bc7527372130ed8d294affa2ab59b2cb2fc0ef916ddb1","ssdeep":"6144:S7gA4VTjGDlZgUYaTD+4Yd0E+brBLAa0ru/dK0rZeP+b0mK8CLv+zQYafOaRfvBZ:rIWdmdBb0mK8CL4gKi","tlshash":"1094e7c9b1e5b0a107b7796c966f800772bad5a238ccc960e51dedc8297c49e4133eb7","size":428908,"data":"","first_seen":"2026-10-07T06:08:28.422132Z","last_seen":"2026-10-14T21:31:18.352184Z","times_seen":110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://moon1.bfsx.net/assets/js/index.dadc7d1f.js","line_number":1,"column_number":449928},{"level":"log","text":"can't access property \"serviceHeadUrl\", s is undefined","filename":"https://moon1.bfsx.net/assets/js/index.dadc7d1f.js","line_number":1,"column_number":17925}]},"http":[{"url":{"schema":"https","addr":"connect.facebook.net/en_US/fbevents.js","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"157.240.200.14","port":443,"asn":32934,"as":"FACEBOOK","country":"Denmark","country_code":"DK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.878Z","timestamp":1791360802878,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 16 Jul 2026 00:00:00 GMT","end":"Wed, 14 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CB:C9:A2:BF:68:AC:DE:97:58:12:5A:A3:91:04:30:33:EB:BA:F2:E7","sha256":"3F:52:56:A1:29:75:00:A3:26:E8:BC:20:2E:83:91:D6:D6:98:F5:B1:CD:E2:30:0F:85:6D:79:A9:61:6A:1C:31"}}},"request":{"raw":"GET /en_US/fbevents.js HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: application/x-javascript; charset=utf-8\r\ntiming-allow-origin: *\r\nreporting-endpoints: coop_report=\"https://www.facebook.com/browser_reporting/coop/?minimize=0\", coep_report=\"https://www.facebook.com/browser_reporting/coep/?minimize=0\", permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\nreport-to: {\"max_age\":2592000,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coop\\/?minimize=0\"}],\"group\":\"coop_report\",\"include_subdomains\":true}, {\"max_age\":86400,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coep\\/?minimize=0\"}],\"group\":\"coep_report\"}, {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ncontent-security-policy: default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-MuNnSKfx';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c\u0026minimize=0;\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-embedder-policy-report-only: require-corp;report-to=\"coep_report\"\r\ncross-origin-opener-policy: same-origin-allow-popups;report-to=\"coop_report\"\r\npragma: public\r\ncache-control: public, max-age=1200\r\nexpires: Sat, 01 Jan 2000 00:00:00 GMT\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\norigin-agent-cluster: ?1\r\nstrict-transport-security: max-age=31536000; preload; includeSubDomains\r\nx-fb-debug: VHCyhedYcfac1r4Of+GKIrChckEGGKlbkL+JDCqpOQGTi/m/YcRkT2KchB4TJ6dgK408cvNwZ80jQbn9x6l/6g==\r\ncontent-length: 112816\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=23, mss=1232, tbw=5093, tp=9, tpl=0, uplat=1, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":428908,"size_decoded":116839,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9255)","md5":"b43439b97b3b28c8e8120e9ae25eae5c","sha1":"e6349d730bb26b4bd4a485cf72b09d7b114f95b9","sha256":"cbdf0712673ad94781b25c743f49d8d6135f59d76ec1c9e060b4b2e259aeb28d","sha512":"d233ffa0baebb730c6ba4789cd6810c37a1cc7334fca9b2d0efb50781a92a007e3023988557012dab48bc7527372130ed8d294affa2ab59b2cb2fc0ef916ddb1","ssdeep":"6144:S7gA4VTjGDlZgUYaTD+4Yd0E+brBLAa0ru/dK0rZeP+b0mK8CLv+zQYafOaRfvBZ:rIWdmdBb0mK8CL4gKi","tlshash":"1094e7c9b1e5b0a107b7796c966f800772bad5a238ccc960e51dedc8297c49e4133eb7","first_seen":"2026-10-07T06:08:28.422132Z","last_seen":"2026-10-14T21:31:18.352184Z","times_seen":110,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":17,"connect":29,"send":0,"wait":23,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/favicon.ico","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:23.685Z","timestamp":1791360803685,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:24 GMT\r\ncontent-type: text/html\r\npriority: u=6,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hDFTCAuiEr75ztXKcdJERXmSO%2B3RCDiIr%2FSclp3zGrfCraBr5BlkrnEeGrA1oNZE7MiR7NzOUtbZzVtDHkDJh15PKWaYFbW73ldbMJahMa17HsZWZknNfihPG%2FkanV%2Fb2g%3D%3D\"}]}\r\ncf-ray: a46b723f0a83b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":153,"size_decoded":720,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"75a85533db026a75af013e6de6789ed7","sha1":"397ced887997e80f51e8b39c5e5fab79ab20404d","sha256":"c7ab5848485a7ce5ee9e599923e155f945b60d327218c07eab3e0f90dff727cf","sha512":"e8465af03944861be7b8ae31b6e98f4bf47c4e29dda0c69c065d0fbe35a3172286b879a8fe14864d519d2e5416a1f4513825eb734dbb84c02f96ddd4429aac0a","ssdeep":"","tlshash":"22c02b6d3913bc4cc563317522c37080c0ca833764ba41114400c00331cf3998ac339b","first_seen":"2026-07-18T08:22:50.94388Z","last_seen":"2026-10-14T17:12:22.167709Z","times_seen":166,"resource_available":true,"data":null}},"time_used":602,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":602,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-07T08:13:21.569Z","timestamp":1791360801569,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j10cmVccZfZ51%2F%2BJStHg6lQ4dX7k5yOxVxhw8BKBZhviArmOpMfQm2%2BUygr%2B3do9cO9v0ptUP0ErE4lo%2BePSvPsypIhTx84Tc7CyQrojt%2BK2L5WKMrFV5LhE0gZPu9o%2B9Q%3D%3D\"}]}\r\nlast-modified: Sun, 04 Oct 2026 14:04:38 GMT\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a46b7231fec9b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2432,"size_decoded":1739,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (1379), with CRLF line terminators","md5":"05b1eca0f3f3ae573b6df7b0f5e570fc","sha1":"741575aeb042fdfe084b8e2886a09eaba4a12fd8","sha256":"146fbdbf9b05b0a38e268e64b94c8362408ee95351de202b3c63dc610ec622c6","sha512":"7b3ee05c7ab619d21d82355a112b28c7705d17242adedf7162f26be27e218a97ed79028bd70d0dcc01ada9c0cb1e8682b315d3dae9dbc05bcd3035ed7936b24e","ssdeep":"","tlshash":"894154e3ac109c1d27709a32ea66f11a996a6124d554ec99f4dc60ed0fe0fc380c3f35","first_seen":"2026-10-07T08:06:02.627115Z","last_seen":"2026-10-10T11:42:16.355507Z","times_seen":9,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":-1,"dns":5,"connect":19,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/lang-index.65952107.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.753Z","timestamp":1791360802753,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/js/lang-index.65952107.js HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:38 GMT\r\npriority: u=3,i=?0\r\netag: W/\"6ac25cf6-817b0\"\r\nage: 439\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jSOsxhNeRFEkuFiiPNPK0rIOsyYLnqJl4MM6vTEevhixiLn3DZh9tQwtiAmu%2BCeGkg66O5KSksa20NVaCOJT1WswOnMQvDgmNCVNTCTe0q1K0ybNMNdeq97fSqZhq1MUjw%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723938f5b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":530352,"size_decoded":170207,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65332), with no line terminators","md5":"e57f7c68a461d4e8c32516f1a0c6bf2a","sha1":"ae7116e0e5698e2ebed1e360e7f9c27d724c4f3a","sha256":"2129add0a7a404f82d6e095b9e8d4d7313bdcc636a007a54dbb2711bb7f2ce48","sha512":"39778fc3842e6c3197b3db5400bc41a04ef9103d899251fa6eb325e4e4a18cf3b04ae24ab52cbfb52e56df25f3816f58fce40baac9d576ec73164e72eb8729d3","ssdeep":"6144:bztDGv8hWpsAeB/9zTqQD4Wf5CsWnfKdMCIElgb1AhgubpdPa0uht+gOZ9AW5yJh:bJaEhW4DnbgObcADEhkL6","tlshash":"3cb49e9cf7d1653ba2981be3bae3e04bd207245e844546628d93f7c44db472ce9e2e31","first_seen":"2026-10-07T08:06:02.621325Z","last_seen":"2026-10-10T11:42:16.359126Z","times_seen":9,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/index.dadc7d1f.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.756Z","timestamp":1791360802756,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/js/index.dadc7d1f.js HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:38 GMT\r\npriority: u=3,i=?0\r\netag: W/\"6ac25cf6-7679b\"\r\nage: 437\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2GpLvwHQpkMSN3HHvCUTfs5H14PV0pqk6BDCqUS5c03SPbdTJni8lC03CUwqwpHalJjyeQgUjt9APcYTBZZBnRSobWBTiH0u49UffHD8SKKkcwxDz9g7XJkeOV4YqQs%2Fug%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723938fbb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":485275,"size_decoded":149007,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65438), with no line terminators","md5":"4c67b54053a6ce1aa4d7e13739b21eb8","sha1":"00105af759653bccfdd0ed99ee9c236ab9c64a03","sha256":"5a40bd0af4f710d84ffea757cdd6e088623078b6648156a2b79bcf23cc147aa4","sha512":"7681dae218975b36790808b94b387d77cb61f81db9b9fe60900b596681f393a6600f3161c228625298bb02f2cc11ef84dee62b4d9251ccda04da87c54501da4d","ssdeep":"6144:Ce+WbYgacEU3vM9E4uCMsfhmXBJGpqx8Z3iK0LGjD2mfc5s6gnxtb/1Ixml:McEU0i0mXB9x8Z3iK0LGXEAxtbN","tlshash":"d0a45b6a7296703247eb91d660af0002f37e5e68644c44acf3b9d4da39a4e5841fbf3d","first_seen":"2026-10-07T08:06:02.616448Z","last_seen":"2026-10-10T11:42:16.301799Z","times_seen":9,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/5911.84f3ac49.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:23.560Z","timestamp":1791360803560,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/js/5911.84f3ac49.js HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:23 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:38 GMT\r\npriority: u=3,i=?0\r\netag: W/\"6ac25cf6-2899\"\r\nage: 436\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NdrSpX%2FdEjTHs857yteNSp0xm1aNgGVSt0lrWew3c2gMzVn5de%2Bp0rMEyO7RlE0jooV3%2BhnD%2FLcBA%2FT211vZGOJRzYyHnPPduHqhvZaUffvVMiZz0nHdqTVzs20IwRM66g%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723e4a41b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10393,"size_decoded":3451,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10393), with no line terminators","md5":"f59b5a07abba63548a7a099a67ed7483","sha1":"7a9b2041210842ba62bda0b47eca2315a8a1fdfe","sha256":"a58ea2d0c3431db95455f853e0416976db1b99a8a75c024dcc071e692811ad75","sha512":"c9a59ebc2d50ef4b63e55dfca1c8c342da4810220688e12eece0af760cf34873d67456176fe110393100e4efc5596adec260ae5345886ea1d552981806ca0d3f","ssdeep":"96:bOVIzUphd8IXAhc56LOCzxC4WQzzVoMyE7aCa1UkOiFYNprala4Gw:bGQW8Thc56LOCzxC4WQeNE7tIFYNprYb","tlshash":"cd22df1a11d6c0e0b3bded532376ae53eab737ba8e4d29c0e954988413f3647e17209d","first_seen":"2026-10-07T08:06:02.625787Z","last_seen":"2026-10-10T11:42:16.345892Z","times_seen":9,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/api/preflight","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:23.936Z","timestamp":1791360803936,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"POST /api/preflight HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: en-US\r\nContent-Type: application/json\r\nContent-Length: 48\r\nOrigin: https://moon1.bfsx.net\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":48,"data":"{\"visitorId\":\"11ed45f7e66284fb3f0be75501723aa8\"}"}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:24 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nset-cookie: JSESSIONID=DD2E9593BA799D4162C93136C48DFAEF; Path=/; Secure; HttpOnly\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wt8qKuB6n7tKRvNidHZF8XmPMUT9L51kKllZsGUpy0Jq61KMwzYVO9K70h4vDGdVV0iqf6lMEztc%2B%2Bds68C96w%2Bq698Qt5y5Y%2FfGny2G7SeXfMCMArOMZKPmH8bqw0DgvQ%3D%3D\"}]}\r\ncf-ray: a46b72409affb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"JSESSIONID","value":"DD2E9593BA799D4162C93136C48DFAEF","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"","partitioned":false,"raw":"JSESSIONID=DD2E9593BA799D4162C93136C48DFAEF; Path=/; Secure; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}],"data":{"size":66,"size_decoded":886,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"a0c497e59182f6e3c11e8b4767fddf07","sha1":"888a266fe9d0fedf8cf1f456b18175cf6bc0ed60","sha256":"4315d732ffe9d81bb62ab669dbdb5b4f380b5f3258df9ad7b3eaa295511845f3","sha512":"fa654ae3957a4be65cfaa2c75f7244b518f64b9664743842b00f877fdbf5dbeac3246037fd9f86106c5312cb5d052caad3e8fa1643e024f651d05084220e0483","ssdeep":"","tlshash":"82a0228800280f302fc28c0c380b2002022032028ca8a82ccc0e80280e28c328302e20","first_seen":"2026-10-07T08:14:20.362071Z","last_seen":"2026-10-07T08:14:20.362071Z","times_seen":1,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/api/config","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:24.159Z","timestamp":1791360804159,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"POST /api/config HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: en-US\r\nContent-Type: application/json\r\nContent-Length: 53\r\nOrigin: https://moon1.bfsx.net\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nCookie: JSESSIONID=DD2E9593BA799D4162C93136C48DFAEF\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"JSESSIONID","value":"DD2E9593BA799D4162C93136C48DFAEF"}],"method":"POST","post_data":{"size":53,"data":"{\"id\":\"5\",\"m\":null,\"reffer\":\"https://moon1.bfsx.net\"}"}},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:24 GMT\r\ncontent-type: application/json;charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FQfjcELzc007JdQJIq2hlP7ZFggWrNwv8K6De9UXkNxmQ%2B%2FHCRUmLbJUbBJEj3M9jVU1SVSwDLHoqr4IUVECLVZbKwA8G%2F2cmDoPSxAv4SVh90W00%2FfDXavK5jepojwl7w%3D%3D\"}]}\r\ncf-ray: a46b7241fb5ab1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39,"size_decoded":776,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"6bcc591aaed8915b39014320fcf7a1e7","sha1":"e22957213b300c3d8dd6a46e4f1e0aad8d8a2838","sha256":"e7431ab24879f4563037f96181521d82f35e6de08db320b2fb28af8a743795f1","sha512":"c9d95a6370719477dad787a7f86b14c10cfab592b010ed91fe74b023a095834d5834aa69632deda346f99b1a37211ddfbcbb13dd0c7e11359603b45dc225ee27","ssdeep":"","tlshash":"299004c0151c1fd55f434055301f3004405431415cd4d41dcc4c511c474c4131101d30","first_seen":"2025-05-10T13:21:01.069852Z","last_seen":"2026-10-10T11:42:16.317164Z","times_seen":33,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Fredoka+One\u0026family=Montserrat:wght@400;600;700;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.750Z","timestamp":1791360802750,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Fredoka+One\u0026family=Montserrat:wght@400;600;700;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 07 Oct 2026 08:13:22 GMT\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10051,"size_decoded":1423,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e9b900c132d182fded2abaa400c2ab1f","sha1":"7429767b220e8401b16a1b77226fdeeb7c2e1f5c","sha256":"2bab103576ad89225f274d14822fbb4eb7bfe840cbd5754f855300e420f1d20e","sha512":"7e11c765abc821bf580cf794ee9f32a893e181dea08de0f6752c43bc1d39a14185a4f0896f64b780787b1e04197b18068badd6ef90d914aaada2e6e17e8aab0f","ssdeep":"192:2wbCRo7TbOCupRS719OYu6RB7W+OfuTRU7XPOOuMR77wIONu8:byQUavdLMrPw","tlshash":"3a22bc91105ba500e7472cc923cf7e26dd4e61627494c579bffe2ca8adeac260325b3d","first_seen":"2026-10-07T08:06:02.613869Z","last_seen":"2026-10-10T11:42:16.319978Z","times_seen":9,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":3,"connect":14,"send":0,"wait":34,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/js/chunk-vendors.ecd83b44.js","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.754Z","timestamp":1791360802754,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/js/chunk-vendors.ecd83b44.js HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:38 GMT\r\npriority: u=3,i=?0\r\netag: W/\"6ac25cf6-3d1f8e\"\r\nage: 439\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DWe%2B4vrf1C%2Fh8QayHpkPPHA6J5fISQ7YhluhJMLcmYxjIbFTfnG6FV%2BmR4eJ%2BSXb%2BCarVzBcTr2E%2B7Lks5UXzun846YKDqikQ15Ice%2B96y%2BIsJ5yp5NmCrBizCcHujnwsA%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723938f6b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4005774,"size_decoded":1192894,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (57267)","md5":"b5db194fe24d287a065978ca24108153","sha1":"5333ab427134e045c18dcb31cf6f5144436ea77f","sha256":"f23f67d4a2e6130970a3cc7f3972236843078822825eb95902bfc6b55dad84fb","sha512":"9fd91e518b689cb4aee5586c26733671ecd199c48332e3afd3836c5f1104c03e05d8a724117fb978e31ca14a9efe3f747c33c7d347287192f5ecc299e494355b","ssdeep":"12288:tjFt5T+8GZN6yG8EQx1jSEDe1vFvFxbYF7PegrYldf5ezKGej7:t9ON6yG8vSEDe1lFx0begrYlH2en","tlshash":"0a254c8072a5b07503db11e5547b1106f339985c740d847cf6ace8ebbfa99899a3bf38","first_seen":"2026-10-07T08:06:02.615269Z","last_seen":"2026-10-10T11:42:16.335809Z","times_seen":9,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/css/chunk-vendors.0d89a8e0.css","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.757Z","timestamp":1791360802757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/css/chunk-vendors.0d89a8e0.css HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:37 GMT\r\npriority: u=2,i=?0\r\netag: W/\"6ac25cf5-248fc\"\r\nage: 439\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OtpQI1rDNNFtsXHUns32NENmQX1yOksn%2BKLGqAi%2FsaB6KUZl4SNme0cIkS2ePSvNlST4qn6EAbilKtAbeZNRfZS3RXcZLQvkpEOmAa%2FQD%2B%2BEq9MsfjV0a0oUEx1C2Pv5DQ%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723938fdb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":149756,"size_decoded":47819,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"c9de479a72661253ca19ef4ac24766c5","sha1":"eae2d91718f641862912bfede47c3be2fbf17a4a","sha256":"c5cbe940962bb8e93f8bbbacb471270e1d78250deecf9007e8e6a7e8314de431","sha512":"414a726d92aea435dd2e1fc17bfd36811952e58314b8610c448592c0c5547443fb0d0b4d9becbc6c02e3ef2276d3e01ff890414f0a6010a90c6b16aeb9e19a51","ssdeep":"1536:BDQbFNJ+jqkiHc4rx3WqyrtpqoSWEDZNYf51SUfeVMJd:BGrxmNH9yDsfrfHJd","tlshash":"4ae3c43786c1235cb217cd25afc4e6c4c228c522f5914feaf2117a2a8fd7bc52196b5b","first_seen":"2026-06-28T22:20:01.82474Z","last_seen":"2026-10-10T11:42:16.309432Z","times_seen":20,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"moon1.bfsx.net/assets/css/index.33508be2.css","fqdn":"moon1.bfsx.net","domain":"bfsx.net","tld":"net"},"ip":{"addr":"172.67.164.105","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://moon1.bfsx.net/","date":"2026-10-07T08:13:22.760Z","timestamp":1791360802760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bfsx.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 28 Aug 2026 21:47:19 GMT","end":"Thu, 26 Nov 2026 22:47:14 GMT"},"fingerprint":{"sha1":"2E:6B:E7:C5:2E:7C:A9:D1:40:38:6E:45:63:2F:43:7B:23:3A:D4:B3","sha256":"81:FE:C4:E7:81:6E:A4:CE:21:3B:26:62:C2:92:97:C3:FC:E4:B1:49:F7:10:46:90:F5:D7:1D:B6:5B:37:99:FB"}}},"request":{"raw":"GET /assets/css/index.33508be2.css HTTP/1.1\r\nHost: moon1.bfsx.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://moon1.bfsx.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 08:13:22 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 04 Oct 2026 14:04:37 GMT\r\npriority: u=2,i=?0\r\netag: W/\"6ac25cf5-cbd2\"\r\nage: 439\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TUk83TyXxWTmFAYZe%2BZLEKBhIJJpiN%2FXgYH9ay6lFDxPt%2FFngBFQvtNgF8KRnpBwAZDfZuU2A%2BLvbMBsi6h07gWLH3O2XN9yOTqZPYCp8wqW5cV7%2FkDkN%2FSy98dG0BykxQ%3D%3D\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a46b723948ffb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52178,"size_decoded":21149,"mime_type":"text/css","magic":"ASCII text, with very long lines (52178), with no line terminators","md5":"06870e24f8c6965abbfe75e71108eaf0","sha1":"b5d3d3e406ea397b493d64ed2ca10b9c50725a42","sha256":"7adf2d4a958b504f1f1468a16d9e2fd2d129a7520d1b5bcf20ebe421a3b8d505","sha512":"4737024446796793de091e8c371eafc42268f203090a3a139e0cff8d0e59d807ed51ad3d4d2dbbdc3e973a1d30300e755f60ceef3bfa537409090be435f87539","ssdeep":"1536:lUtSooUNDgL1Vrk84QA8uaA3PMKw3GYtppF0KxCsMiV95hR9HjReG:aMKwWYV","tlshash":"86333d74bb096527b87fc18d64e8e9584c39a9c3e4125fa9b73722264dcb38336f524c","first_seen":"2026-08-29T02:13:26.027831Z","last_seen":"2026-10-10T11:42:16.315263Z","times_seen":13,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"moon1.bfsx.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}