{ "type": "Domain", "indicator": "avastpy.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/avastpy.com", "alexa": "http://www.alexa.com/siteinfo/avastpy.com", "indicator": "avastpy.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3991044553, "indicator": "avastpy.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "67c586b5bacba874edce2bcb", "name": "PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks", "description": "The Russian autonomous system PROSPERO (AS200593) could be linked with a high level of confidence to Proton66 (AS198953), another Russian AS, that we believe to be connected to the bulletproof services named \u2018SecureHost\u2018 and \u2018BEARHOST\u2018. We notably observed that both network\u2019s configurations are almost identical in terms of peering agreements and their respective share of loads throughout time.", "modified": "2025-04-29T14:22:22.704000", "created": "2025-03-03T10:38:45.845000", "tags": [], "references": [ "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 13, "URL": 20, "domain": 100, "email": 2, "hostname": 9 }, "indicator_count": 144, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "397 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "678d7073fb63221189a2d758", "name": "AVAST phishing", "description": "", "modified": "2025-01-19T21:44:27.264000", "created": "2025-01-19T21:36:51.163000", "tags": [ "phishing" ], "references": [ "https://www.cyfirma.com/research/spynote-unmasking-a-sophisticated-android-malware/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SpyNote", "display_name": "SpyNote", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 25, "hostname": 1 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "497 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673d1d8277f02ab819dbd640", "name": "TI Advisory No-ESAF-SOC-TI-409", "description": "", "modified": "2024-11-19T23:21:38.978000", "created": "2024-11-19T23:21:38.978000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "domain": 14, "URL": 1 }, "indicator_count": 18, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "558 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673a81c2706aed08358e6b7c", "name": "SpyNote Malware Targets Android Devices with Fake Antivirus Scheme", "description": "", "modified": "2024-11-17T23:52:34.640000", "created": "2024-11-17T23:52:34.640000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 14 }, "indicator_count": 14, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "560 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6709b0aee79c25ff8275d77e", "name": "URLHaus data - 11-10-2024", "description": "", "modified": "2024-11-10T23:02:55.870000", "created": "2024-10-11T23:11:42.041000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "botnetdomain", "gafgyt", "ua-wget", "SocGholish", "downloader", "Lumma", "ps1", "exe", "zip", "CobaltStrike", "32", "apk", "Avastavv.apk", "SpyNote", "NanoCore", "opendir", "ascii", "VIPKeylogger", "jpg-base64-loader", "Encoded", "encrypted", "GuLoader", "Formbook", "js", "xworm", "MassLogger", "LummaStealer", "dll", "Stealc", "stealer", "Password-protected", "Verus", "powershell", "ScrInject", "Metasploit", "healer", "AmosStealer", "dmg" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 10, "hostname": 9 }, "indicator_count": 1019, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "567 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/", "https://urlhaus.abuse.ch/browse/", "https://www.cyfirma.com/research/spynote-unmasking-a-sophisticated-android-malware/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Spynote" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "67c586b5bacba874edce2bcb", "name": "PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks", "description": "The Russian autonomous system PROSPERO (AS200593) could be linked with a high level of confidence to Proton66 (AS198953), another Russian AS, that we believe to be connected to the bulletproof services named \u2018SecureHost\u2018 and \u2018BEARHOST\u2018. We notably observed that both network\u2019s configurations are almost identical in terms of peering agreements and their respective share of loads throughout time.", "modified": "2025-04-29T14:22:22.704000", "created": "2025-03-03T10:38:45.845000", "tags": [], "references": [ "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 13, "URL": 20, "domain": 100, "email": 2, "hostname": 9 }, "indicator_count": 144, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "397 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "678d7073fb63221189a2d758", "name": "AVAST phishing", "description": "", "modified": "2025-01-19T21:44:27.264000", "created": "2025-01-19T21:36:51.163000", "tags": [ "phishing" ], "references": [ "https://www.cyfirma.com/research/spynote-unmasking-a-sophisticated-android-malware/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SpyNote", "display_name": "SpyNote", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 25, "hostname": 1 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "497 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673d1d8277f02ab819dbd640", "name": "TI Advisory No-ESAF-SOC-TI-409", "description": "", "modified": "2024-11-19T23:21:38.978000", "created": "2024-11-19T23:21:38.978000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "domain": 14, "URL": 1 }, "indicator_count": 18, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "558 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673a81c2706aed08358e6b7c", "name": "SpyNote Malware Targets Android Devices with Fake Antivirus Scheme", "description": "", "modified": "2024-11-17T23:52:34.640000", "created": "2024-11-17T23:52:34.640000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 14 }, "indicator_count": 14, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "560 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6709b0aee79c25ff8275d77e", "name": "URLHaus data - 11-10-2024", "description": "", "modified": "2024-11-10T23:02:55.870000", "created": "2024-10-11T23:11:42.041000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "botnetdomain", "gafgyt", "ua-wget", "SocGholish", "downloader", "Lumma", "ps1", "exe", "zip", "CobaltStrike", "32", "apk", "Avastavv.apk", "SpyNote", "NanoCore", "opendir", "ascii", "VIPKeylogger", "jpg-base64-loader", "Encoded", "encrypted", "GuLoader", "Formbook", "js", "xworm", "MassLogger", "LummaStealer", "dll", "Stealc", "stealer", "Password-protected", "Verus", "powershell", "ScrInject", "Metasploit", "healer", "AmosStealer", "dmg" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 10, "hostname": 9 }, "indicator_count": 1019, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "567 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "avastpy.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "avastpy.com", "found": true, "verdict": "malicious", "url_count": 2, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://avastpy.com/Avastavv.apk", "status": "offline", "threat": "malware_download", "date_added": "2024-10-11", "tags": [ "apk ", "Avastavv.apk", "SpyNote" ] }, { "url": "http://avastpy.com/Avastavv.apk", "status": "offline", "threat": "malware_download", "date_added": "2024-10-11", "tags": [ "apk ", "Avastavv.apk", "SpyNote" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780284793.933023 }