{ "type": "Domain", "indicator": "almost4x4.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/almost4x4.com", "alexa": "http://www.alexa.com/siteinfo/almost4x4.com", "indicator": "almost4x4.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3667339895, "indicator": "almost4x4.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "68be65e95645ef1a6c8a898d", "name": "Apple affected by Tofsee at least 4 remote devices. DEAD Apple products", "description": "Such a hacked device. Victims phone remotely accessed the night it was purchased. A man wearing a jammer/ deauth watch was part of an aggressive caravan of followers. Will repost related pulse. \n South Africa became customer service once again for every external service called. Target was aware. \n\nIt must be nice to SA someone, and have a racist mafia of silencers behind because the corporation didn\u2019t want bad press and the Sheriff was friends with the MD who threatened victim with future retaliation.\n\nNo one helps because this is obviously abuse by law enforcement. He is the victim. She simply suffered from life threatening injuries until the end. This should be illegal. Denied justice, representation, medical care, emergency care of any kind, diagnos3s and followed and monitored 24/7.", "modified": "2025-10-08T04:04:41.943000", "created": "2025-09-08T05:13:13.781000", "tags": [ "mtb oct", "trojandropper", "avast avg", "backdoor", "trojan", "ubuntu", "passive dns", "federation flag", "asn as49505", "dns resolutions", "domains top", "level", "unique tlds", "dynamicloader", "high", "medium", "port", "delete c", "windows", "displayname", "tofsee", "grum", "stream", "powershell", "write", "malware", "hostile", "misa", "ipv4 add", "urls", "files", "learn", "ck id", "name tactics", "suspicious", "informative", "found", "command", "defense evasion", "adversaries", "spawns", "united", "orc5", "flag", "rhur3d", "title", "click", "strings", "refresh", "aids", "dzan", "sumo", "miny", "judi", "pattern match", "mitre att", "show technique", "ck matrix", "ascii text", "show process", "hybrid", "general", "local", "path", "t1480 execution", "null", "span", "error", "tools", "look", "verify", "restart", "domain secure", "windows nt", "ogoogle trust", "zerossl ecc", "site ca0x1ex17r", "win64", "unknown", "encrypt", "search", "entries", "destination", "push", "next", "apple", "moved", "gmt content", "type", "content length", "ipv4", "date", "handle", "address range", "cidr", "network name", "allocation type", "assigned pi", "status", "whois server", "entity ipripe", "apnic", "url add", "http", "hostname", "files domain", "files related", "related tags", "ip address", "related nids", "files location", "flag united", "unknown ns", "name servers", "creation date", "emails", "pulse pulses", "pulses none", "none google", "safe browsing", "external", "location united", "asn as714", "less whois", "registrar", "ios", "iphone", "ipad", "australia", "dead host" ], "references": [ "https://idmsa.apple.com/ \u2022 account.apple.com \u2022 appleid.apple.com \u2022 http://www.apple.com/filenotfound", "https://176.113.115.136/ohhiiiii/", "https://appleid.apple.com/cgi-bin/WebObjects/MyAppleIdCVE", "https://ipadaustralia.com/mim/93tkkjy9zc9fv796398p4e8425id90u4u727g7094724c0a9i8", "palantir-staging.staging.candidate.app.paulsjob.ai", "pornhub.com\t \u2022 www.pornhub.com", "appleaustralia.com", "https://hybrid-analysis.com/sample/a871c76756ddf6d18d728b668d011e9d04e9db9c79734450a562f1f4b6ba2cdc/68be456cd90e6cbdf30d2afb", "https://hybrid-analysis.com/sample/35dce2c9c408e751622991b0655871f35ab97106fa87c233dfa2b135b4014df4/68be451808aeabd5cc0e9e85" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Muldrop", "display_name": "Muldrop", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Telecommunications", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1273, "FileHash-MD5": 347, "domain": 606, "hostname": 778, "FileHash-SHA256": 2724, "FileHash-SHA1": 322, "email": 9, "SSLCertFingerprint": 14, "CIDR": 3 }, "indicator_count": 6076, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "236 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65726005eda390785a43756b", "name": "URLHaus data - 07-12-2023", "description": "", "modified": "2024-01-07T00:02:50.659000", "created": "2023-12-08T00:15:01.026000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "dropped-by-PrivateLoader", "32", "exe", "Stealc", "encrypted", "hajime", "dll", "RecordBreaker", "wsf", "ddos", "mirai", "RemcosRAT", "reversed-base64-encoded-exe", "GuLoader", "rat", "PrivateLoader", "risepro", "RedLineStealer", "RedLine", "njRAT", "BRA", "geofenced", "zip", "geo", "msi", "Pikabot", "TA577", "TR", "dropped-by-SmokeLoader", "Smoke Loader", "shellscript", "js", "glupteba", "smokeloader", "xmrig", "remcos", "doc", "Formbook", "opendir", "AgentTesla", "ascii", "AsyncRAT", "Encoded", "xworm", "RevengeRAT", "Amadey", "discord", "game", "npm", "AveMariaRAT", "QuasarRAT", "bookinggoogledrive", "pw-123456", "stealer", "zgRAT", "LummaStealer", "x86-32" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 71, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 416, "hostname": 15, "domain": 160 }, "indicator_count": 591, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "876 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65710e84b4d4399425ea87d6", "name": "URLHaus data - 06-12-2023", "description": "", "modified": "2024-01-06T00:05:04.107000", "created": "2023-12-07T00:15:00.296000", "tags": [ "exe", "remcos", "32", "RedLineStealer", "Amadey", "dropped-by-PrivateLoader", "elf", "Mozi", "64-bit", "x86-64", "32-bit", "mips", "hajime", "TR", "js", "wsf", "glupteba", "Rhadamanthys", "Stealc", "mirai", "xworm", "encrypted", "GuLoader", "rat", "RemcosRAT", "123", "Password-protected", "zip", "AsyncRAT", "njRAT", "PrivateLoader", "risepro", "LummaStealer", "BlankGrabber", "arm", "64", "zgRAT", "dll", "RecordBreaker", "msi", "2023", "rar", "reversed-base64-encoded-exe", "shark", "RedLine", "AgentTesla", "younglotus", "dcrat", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 333, "domain": 152, "hostname": 17 }, "indicator_count": 502, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "877 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "656530c390f6908763d73f01", "name": "URLHaus data - 27-11-2023", "description": "", "modified": "2023-12-28T00:01:20.880000", "created": "2023-11-28T00:13:55.541000", "tags": [ "32-bit", "elf", "mips", "Mozi", "dropped-by-PrivateLoader", "encrypted", "SocGholish", "AgentTesla", "mirai", "x86-32", "hajime", "js", "32", "exe", "xworm", "AsyncRAT", "wsf", "glupteba", "IcedID", "TR", "RedLine", "img", "TA577", "xmrig", "Formbook", "opendir", "doc", "6056", "pw-6056", "remcos", "3305", "pw-3305", "1168", "pw-1168", "1220", "pw-1220", "5687", "pw-5687", "3701", "pw-3701", "2764", "pw-2764", "1682", "pw-1682", "7845", "pw-7845", "3276", "pw-3276", "6512", "pw-6512", "5674", "pw-5674", "3278", "pw-3278", "5621", "pw-5621", "2709", "pw-2709", "3691", "pw-3691", "1885", "pw-1885", "2023", "pw-2023", "1122", "pw-1122", "3939", "pw-3939", "1225", "pw-1225", "3289", "pw-3289", "RedLineStealer", "agenziaentrate", "geo", "geofenced", "ITA", "RemcosRAT", "bz", "revenge", "stego", "zgRAT", "GuLoader", "ascii", "hta", "zip", "dcrat", "Encoded", "vbs", "powershell", "ps", "rat", "1234", "Password-protected", "rar", "infostealer", "gz", "redir-302", "dropped-by-SmokeLoader", "Amadey", "iso", "android", "apk", "IRATA" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 62, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 443, "hostname": 51, "domain": 167 }, "indicator_count": 661, "is_author": false, "is_subscribing": null, "subscriber_count": 1626, "modified_text": "886 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65555ec42ae218264c863864", "name": "URLHaus data - 15-11-2023", "description": "", "modified": "2023-12-16T00:02:45.114000", "created": "2023-11-16T00:13:56.224000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "elf", "Mozi", "64", "32-bit", "mips", "mirai", "zip", "SocGholish", "hajime", "PowerShellDropboxStealer", "RedLine", "zgRAT", "djvu", "exe", "VoidRAT", "Amadey", "glupteba", "PrivateLoader", "smokeloader", "xmrig", "dll", "RecordBreaker", "123", "Password-protected", "vbs", "agenziaentrate", "RemcosRAT", "stego", "from-Ghostpulse", "includes-Lumma", "Pikabot", "TA577", "TR", "powershell", "PowerShellMeterpreterReverseTCPx64", "Raccoon", "risepro", "geo", "geofenced", "ITA", "DarkGate", "PureLogs", "dropped-by-SmokeLoader", "SystemBC", "AgentTesla", "Formbook", "ua-curl", "js", "rar", "remcos", "peng", "9842", "2023", "gafgyt", "shellscript", "njRAT", "32", "RedLineStealer", "Arechclient2" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 477, "domain": 255, "hostname": 23 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "898 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654d7639a527bc5b18e972db", "name": "URLHaus data - 09-11-2023", "description": "", "modified": "2023-12-10T00:02:59.273000", "created": "2023-11-10T00:15:53.935000", "tags": [ "32-bit", "elf", "mips", "Mozi", "32", "mirai", "motorola", "arm", "sparc", "PowerPC", "renesas", "hajime", "64", "exe", "RedLineStealer", "x86-32", "dropped-by-PrivateLoader", "encrypted", "PrivateLoader", "risepro", "dll", "RecordBreaker", "Stealc", "dropped-by-SmokeLoader", "SystemBC", "PowerShellDropboxScreenStealer", "botnet-PLEX", "DarkGate", "geofenced", "USA", "Raccoon", "redir-302", "RedLine", "url", "js", "Pikabot", "pw-H17", "TR", "zip", "ua-curl", "jar", "ace", "7z", "AgentTesla", "emotet", "heodo", "vbs", "doc", "opendir", "remcos", "Kutaki", "GuLoader", "Formbook", "Smoke Loader", "Loki", "QuasarRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 407, "domain": 216, "hostname": 9 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "904 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654980e5cd415fea7902d465", "name": "URLHaus data - 06-11-2023", "description": "", "modified": "2023-12-07T00:00:30.220000", "created": "2023-11-07T00:12:21.258000", "tags": [ "32-bit", "elf", "mips", "Mozi", "exe", "njRAT", "hajime", "32", "64", "CoinMiner", "mirai", "sparc", "arm", "PowerPC", "renesas", "motorola", "Pikabot", "TA577", "TR", "dropped-by-PrivateLoader", "glupteba", "Vidar", "encrypted", "Raccoon", "x86-32", "RedLine", "ArkeiStealer", "AgentTesla", "GuLoader", "rat", "RemcosRAT", "dll", "Stealc", "android", "apk", "IRATA", "ua-curl", "pw-H17", "zip", "PrivateLoader", "1234", "Password-protected", "rar", "dropped-by-SmokeLoader", "RedLineStealer", "Phobos", "SystemBC", "ascii", "Encoded", "Formbook", "SocGholish", "2023", "Smoke Loader", "AsyncRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 619, "domain": 462, "hostname": 14 }, "indicator_count": 1095, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1139 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "pornhub.com\t \u2022 www.pornhub.com", "appleaustralia.com", "https://idmsa.apple.com/ \u2022 account.apple.com \u2022 appleid.apple.com \u2022 http://www.apple.com/filenotfound", "https://urlhaus.abuse.ch/browse/", "https://hybrid-analysis.com/sample/a871c76756ddf6d18d728b668d011e9d04e9db9c79734450a562f1f4b6ba2cdc/68be456cd90e6cbdf30d2afb", "https://ipadaustralia.com/mim/93tkkjy9zc9fv796398p4e8425id90u4u727g7094724c0a9i8", "https://appleid.apple.com/cgi-bin/WebObjects/MyAppleIdCVE", "https://hybrid-analysis.com/sample/35dce2c9c408e751622991b0655871f35ab97106fa87c233dfa2b135b4014df4/68be451808aeabd5cc0e9e85", "palantir-staging.staging.candidate.app.paulsjob.ai", "https://176.113.115.136/ohhiiiii/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Apnic", "Muldrop", "Win.packer.pkr_ce1a-9980177-0", "Tofsee" ], "industries": [ "Technology", "Telecommunications" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "68be65e95645ef1a6c8a898d", "name": "Apple affected by Tofsee at least 4 remote devices. DEAD Apple products", "description": "Such a hacked device. Victims phone remotely accessed the night it was purchased. A man wearing a jammer/ deauth watch was part of an aggressive caravan of followers. Will repost related pulse. \n South Africa became customer service once again for every external service called. Target was aware. \n\nIt must be nice to SA someone, and have a racist mafia of silencers behind because the corporation didn\u2019t want bad press and the Sheriff was friends with the MD who threatened victim with future retaliation.\n\nNo one helps because this is obviously abuse by law enforcement. He is the victim. She simply suffered from life threatening injuries until the end. This should be illegal. Denied justice, representation, medical care, emergency care of any kind, diagnos3s and followed and monitored 24/7.", "modified": "2025-10-08T04:04:41.943000", "created": "2025-09-08T05:13:13.781000", "tags": [ "mtb oct", "trojandropper", "avast avg", "backdoor", "trojan", "ubuntu", "passive dns", "federation flag", "asn as49505", "dns resolutions", "domains top", "level", "unique tlds", "dynamicloader", "high", "medium", "port", "delete c", "windows", "displayname", "tofsee", "grum", "stream", "powershell", "write", "malware", "hostile", "misa", "ipv4 add", "urls", "files", "learn", "ck id", "name tactics", "suspicious", "informative", "found", "command", "defense evasion", "adversaries", "spawns", "united", "orc5", "flag", "rhur3d", "title", "click", "strings", "refresh", "aids", "dzan", "sumo", "miny", "judi", "pattern match", "mitre att", "show technique", "ck matrix", "ascii text", "show process", "hybrid", "general", "local", "path", "t1480 execution", "null", "span", "error", "tools", "look", "verify", "restart", "domain secure", "windows nt", "ogoogle trust", "zerossl ecc", "site ca0x1ex17r", "win64", "unknown", "encrypt", "search", "entries", "destination", "push", "next", "apple", "moved", "gmt content", "type", "content length", "ipv4", "date", "handle", "address range", "cidr", "network name", "allocation type", "assigned pi", "status", "whois server", "entity ipripe", "apnic", "url add", "http", "hostname", "files domain", "files related", "related tags", "ip address", "related nids", "files location", "flag united", "unknown ns", "name servers", "creation date", "emails", "pulse pulses", "pulses none", "none google", "safe browsing", "external", "location united", "asn as714", "less whois", "registrar", "ios", "iphone", "ipad", "australia", "dead host" ], "references": [ "https://idmsa.apple.com/ \u2022 account.apple.com \u2022 appleid.apple.com \u2022 http://www.apple.com/filenotfound", "https://176.113.115.136/ohhiiiii/", "https://appleid.apple.com/cgi-bin/WebObjects/MyAppleIdCVE", "https://ipadaustralia.com/mim/93tkkjy9zc9fv796398p4e8425id90u4u727g7094724c0a9i8", "palantir-staging.staging.candidate.app.paulsjob.ai", "pornhub.com\t \u2022 www.pornhub.com", "appleaustralia.com", "https://hybrid-analysis.com/sample/a871c76756ddf6d18d728b668d011e9d04e9db9c79734450a562f1f4b6ba2cdc/68be456cd90e6cbdf30d2afb", "https://hybrid-analysis.com/sample/35dce2c9c408e751622991b0655871f35ab97106fa87c233dfa2b135b4014df4/68be451808aeabd5cc0e9e85" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Muldrop", "display_name": "Muldrop", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Telecommunications", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1273, "FileHash-MD5": 347, "domain": 606, "hostname": 778, "FileHash-SHA256": 2724, "FileHash-SHA1": 322, "email": 9, "SSLCertFingerprint": 14, "CIDR": 3 }, "indicator_count": 6076, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "236 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65726005eda390785a43756b", "name": "URLHaus data - 07-12-2023", "description": "", "modified": "2024-01-07T00:02:50.659000", "created": "2023-12-08T00:15:01.026000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "dropped-by-PrivateLoader", "32", "exe", "Stealc", "encrypted", "hajime", "dll", "RecordBreaker", "wsf", "ddos", "mirai", "RemcosRAT", "reversed-base64-encoded-exe", "GuLoader", "rat", "PrivateLoader", "risepro", "RedLineStealer", "RedLine", "njRAT", "BRA", "geofenced", "zip", "geo", "msi", "Pikabot", "TA577", "TR", "dropped-by-SmokeLoader", "Smoke Loader", "shellscript", "js", "glupteba", "smokeloader", "xmrig", "remcos", "doc", "Formbook", "opendir", "AgentTesla", "ascii", "AsyncRAT", "Encoded", "xworm", "RevengeRAT", "Amadey", "discord", "game", "npm", "AveMariaRAT", "QuasarRAT", "bookinggoogledrive", "pw-123456", "stealer", "zgRAT", "LummaStealer", "x86-32" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 71, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 416, "hostname": 15, "domain": 160 }, "indicator_count": 591, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "876 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65710e84b4d4399425ea87d6", "name": "URLHaus data - 06-12-2023", "description": "", "modified": "2024-01-06T00:05:04.107000", "created": "2023-12-07T00:15:00.296000", "tags": [ "exe", "remcos", "32", "RedLineStealer", "Amadey", "dropped-by-PrivateLoader", "elf", "Mozi", "64-bit", "x86-64", "32-bit", "mips", "hajime", "TR", "js", "wsf", "glupteba", "Rhadamanthys", "Stealc", "mirai", "xworm", "encrypted", "GuLoader", "rat", "RemcosRAT", "123", "Password-protected", "zip", "AsyncRAT", "njRAT", "PrivateLoader", "risepro", "LummaStealer", "BlankGrabber", "arm", "64", "zgRAT", "dll", "RecordBreaker", "msi", "2023", "rar", "reversed-base64-encoded-exe", "shark", "RedLine", "AgentTesla", "younglotus", "dcrat", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 333, "domain": 152, "hostname": 17 }, "indicator_count": 502, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "877 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "656530c390f6908763d73f01", "name": "URLHaus data - 27-11-2023", "description": "", "modified": "2023-12-28T00:01:20.880000", "created": "2023-11-28T00:13:55.541000", "tags": [ "32-bit", "elf", "mips", "Mozi", "dropped-by-PrivateLoader", "encrypted", "SocGholish", "AgentTesla", "mirai", "x86-32", "hajime", "js", "32", "exe", "xworm", "AsyncRAT", "wsf", "glupteba", "IcedID", "TR", "RedLine", "img", "TA577", "xmrig", "Formbook", "opendir", "doc", "6056", "pw-6056", "remcos", "3305", "pw-3305", "1168", "pw-1168", "1220", "pw-1220", "5687", "pw-5687", "3701", "pw-3701", "2764", "pw-2764", "1682", "pw-1682", "7845", "pw-7845", "3276", "pw-3276", "6512", "pw-6512", "5674", "pw-5674", "3278", "pw-3278", "5621", "pw-5621", "2709", "pw-2709", "3691", "pw-3691", "1885", "pw-1885", "2023", "pw-2023", "1122", "pw-1122", "3939", "pw-3939", "1225", "pw-1225", "3289", "pw-3289", "RedLineStealer", "agenziaentrate", "geo", "geofenced", "ITA", "RemcosRAT", "bz", "revenge", "stego", "zgRAT", "GuLoader", "ascii", "hta", "zip", "dcrat", "Encoded", "vbs", "powershell", "ps", "rat", "1234", "Password-protected", "rar", "infostealer", "gz", "redir-302", "dropped-by-SmokeLoader", "Amadey", "iso", "android", "apk", "IRATA" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 62, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 443, "hostname": 51, "domain": 167 }, "indicator_count": 661, "is_author": false, "is_subscribing": null, "subscriber_count": 1626, "modified_text": "886 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65555ec42ae218264c863864", "name": "URLHaus data - 15-11-2023", "description": "", "modified": "2023-12-16T00:02:45.114000", "created": "2023-11-16T00:13:56.224000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "elf", "Mozi", "64", "32-bit", "mips", "mirai", "zip", "SocGholish", "hajime", "PowerShellDropboxStealer", "RedLine", "zgRAT", "djvu", "exe", "VoidRAT", "Amadey", "glupteba", "PrivateLoader", "smokeloader", "xmrig", "dll", "RecordBreaker", "123", "Password-protected", "vbs", "agenziaentrate", "RemcosRAT", "stego", "from-Ghostpulse", "includes-Lumma", "Pikabot", "TA577", "TR", "powershell", "PowerShellMeterpreterReverseTCPx64", "Raccoon", "risepro", "geo", "geofenced", "ITA", "DarkGate", "PureLogs", "dropped-by-SmokeLoader", "SystemBC", "AgentTesla", "Formbook", "ua-curl", "js", "rar", "remcos", "peng", "9842", "2023", "gafgyt", "shellscript", "njRAT", "32", "RedLineStealer", "Arechclient2" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 477, "domain": 255, "hostname": 23 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "898 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654d7639a527bc5b18e972db", "name": "URLHaus data - 09-11-2023", "description": "", "modified": "2023-12-10T00:02:59.273000", "created": "2023-11-10T00:15:53.935000", "tags": [ "32-bit", "elf", "mips", "Mozi", "32", "mirai", "motorola", "arm", "sparc", "PowerPC", "renesas", "hajime", "64", "exe", "RedLineStealer", "x86-32", "dropped-by-PrivateLoader", "encrypted", "PrivateLoader", "risepro", "dll", "RecordBreaker", "Stealc", "dropped-by-SmokeLoader", "SystemBC", "PowerShellDropboxScreenStealer", "botnet-PLEX", "DarkGate", "geofenced", "USA", "Raccoon", "redir-302", "RedLine", "url", "js", "Pikabot", "pw-H17", "TR", "zip", "ua-curl", "jar", "ace", "7z", "AgentTesla", "emotet", "heodo", "vbs", "doc", "opendir", "remcos", "Kutaki", "GuLoader", "Formbook", "Smoke Loader", "Loki", "QuasarRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 407, "domain": 216, "hostname": 9 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "904 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654980e5cd415fea7902d465", "name": "URLHaus data - 06-11-2023", "description": "", "modified": "2023-12-07T00:00:30.220000", "created": "2023-11-07T00:12:21.258000", "tags": [ "32-bit", "elf", "mips", "Mozi", "exe", "njRAT", "hajime", "32", "64", "CoinMiner", "mirai", "sparc", "arm", "PowerPC", "renesas", "motorola", "Pikabot", "TA577", "TR", "dropped-by-PrivateLoader", "glupteba", "Vidar", "encrypted", "Raccoon", "x86-32", "RedLine", "ArkeiStealer", "AgentTesla", "GuLoader", "rat", "RemcosRAT", "dll", "Stealc", "android", "apk", "IRATA", "ua-curl", "pw-H17", "zip", "PrivateLoader", "1234", "Password-protected", "rar", "dropped-by-SmokeLoader", "RedLineStealer", "Phobos", "SystemBC", "ascii", "Encoded", "Formbook", "SocGholish", "2023", "Smoke Loader", "AsyncRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 619, "domain": 462, "hostname": 14 }, "indicator_count": 1095, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1139 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "almost4x4.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "almost4x4.com", "found": true, "verdict": "malicious", "url_count": 7, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://almost4x4.com/ee/", "status": "offline", "threat": "malware_download", "date_added": "2023-12-07", "tags": [ "msi", "Pikabot", "TA577", "TR", "zip" ] }, { "url": "https://almost4x4.com/ste/", "status": "offline", "threat": "malware_download", "date_added": "2023-12-06", "tags": [ "Pikabot", "TR" ] }, { "url": "https://almost4x4.com/rotl/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-27", "tags": [ "IcedID", "TR" ] }, { "url": "https://almost4x4.com/qfos/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-15", "tags": [ "js", "Pikabot", "TR", "zip" ] }, { "url": "https://almost4x4.com/miu/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-09", "tags": [ "js", "Pikabot", "pw-H17", "TR", "zip" ] }, { "url": "https://almost4x4.com/npot/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-06", "tags": [ "Pikabot", "TA577", "TR" ] }, { "url": "https://almost4x4.com/sync/moskva.zip", "status": "offline", "threat": "malware_download", "date_added": "2023-04-19", "tags": [ "geofenced", "obama253", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780357896.2815747 }