{
  "type": "Domain",
  "indicator": "aver.digital",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/aver.digital",
    "alexa": "http://www.alexa.com/siteinfo/aver.digital",
    "indicator": "aver.digital",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4088321436,
      "indicator": "aver.digital",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "687059a339b3b2a79765dbec",
          "name": "inverte",
          "description": "",
          "modified": "2026-02-01T17:53:50.806000",
          "created": "2025-07-11T00:24:03.079000",
          "tags": [],
          "references": [
            "https://github.com/Abjuri5t/SarlackLab/raw/refs/heads/main/IOCs.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 10129,
            "URL": 14767,
            "domain": 3421,
            "hostname": 7022,
            "CVE": 7
          },
          "indicator_count": 35346,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 186,
          "modified_text": "120 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "686d28ec9208b0424e0ccad2",
          "name": "Remote Keylogger | Foundry",
          "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
          "modified": "2025-09-19T03:02:22.742000",
          "created": "2025-07-08T14:19:24.211000",
          "tags": [
            "delete",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "intel",
            "write",
            "malware",
            "dynamicloader",
            "yara rule",
            "high",
            "vmware",
            "phishing",
            "remote",
            "keylogger",
            "remote keylogger",
            "type indicator",
            "related pulses",
            "no expiration",
            "url https",
            "showing",
            "reputation",
            "foundry",
            "apple",
            "downloader",
            "trojan"
          ],
          "references": [
            "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
            "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
            "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
            "\u2022  199.59.243.226",
            "\u2022 ww25.vpn.steamcommunity-site.info",
            "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
            "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
            "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
            "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
            "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Reputation.1",
              "display_name": "Reputation.1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 4406,
            "URL": 9684,
            "domain": 3164,
            "hostname": 3370,
            "CVE": 1
          },
          "indicator_count": 21129,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 148,
          "modified_text": "255 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://github.com/Abjuri5t/SarlackLab/raw/refs/heads/main/IOCs.csv",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022  199.59.243.226",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Reputation.1",
            "Unruy"
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Media"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "687059a339b3b2a79765dbec",
      "name": "inverte",
      "description": "",
      "modified": "2026-02-01T17:53:50.806000",
      "created": "2025-07-11T00:24:03.079000",
      "tags": [],
      "references": [
        "https://github.com/Abjuri5t/SarlackLab/raw/refs/heads/main/IOCs.csv"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 10129,
        "URL": 14767,
        "domain": 3421,
        "hostname": 7022,
        "CVE": 7
      },
      "indicator_count": 35346,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 186,
      "modified_text": "120 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "686d28ec9208b0424e0ccad2",
      "name": "Remote Keylogger | Foundry",
      "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
      "modified": "2025-09-19T03:02:22.742000",
      "created": "2025-07-08T14:19:24.211000",
      "tags": [
        "delete",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "intel",
        "write",
        "malware",
        "dynamicloader",
        "yara rule",
        "high",
        "vmware",
        "phishing",
        "remote",
        "keylogger",
        "remote keylogger",
        "type indicator",
        "related pulses",
        "no expiration",
        "url https",
        "showing",
        "reputation",
        "foundry",
        "apple",
        "downloader",
        "trojan"
      ],
      "references": [
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022  199.59.243.226",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Reputation.1",
          "display_name": "Reputation.1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 260,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 4406,
        "URL": 9684,
        "domain": 3164,
        "hostname": 3370,
        "CVE": 1
      },
      "indicator_count": 21129,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 148,
      "modified_text": "255 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "aver.digital",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "aver.digital",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780337667.5217006
}