{ "type": "Domain", "indicator": "bashupload.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/bashupload.com", "alexa": "http://www.alexa.com/siteinfo/bashupload.com", "indicator": "bashupload.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3253411257, "indicator": "bashupload.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 50, "pulses": [ { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "19 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699a1693d2554dc119a0d38c", "name": "Sticky trail: exploring the attacks of the PseudoSticky faction", "description": "In November 2025, F6 experts uncovered a coordinated malicious campaign attributed to a group known as PseudoSticky. This operation revealed a comprehensive and sophisticated array of malware activities, demonstrating a clear link to the previously identified Sticky Werewolf threat actor. This connection was evident through shared tactics, techniques, and procedures (TTPs) as well as specific tools utilized in their operations, suggesting a collaboration or shared methodology between the two factions.\n\nBy December 2025, the PseudoSticky group escalated their operations, specifically through targeted phishing campaigns aimed at companies within the retail and construction sectors. This strategy highlighted the group's ability to adapt its social engineering tactics to appeal to specific industries, potentially leveraging seasonal themes for increased effectiveness, as suggested by the timing of their operations around the Christmas period.", "modified": "2026-03-23T20:05:30.881000", "created": "2026-02-21T20:33:23.145000", "tags": [ "strong", "temp", "pseudosticky", "darktrack", "sticky", "werewolf", "ttps", "sticky werewolf", "nsis", "pe32", "remcos", "purecrypter", "f6" ], "references": [ "https://www.f6.ru/blog/pseudo-sticky/" ], "public": 1, "adversary": "PseudoSticky", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1137", "name": "Office Application Startup", "display_name": "T1137 - Office Application Startup" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "hostname": 2, "FileHash-MD5": 21, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 7 }, "indicator_count": 70, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697974428ee6adba0849b139", "name": "URLHaus data - 27-01-2026 (Part 2)", "description": "", "modified": "2026-02-27T02:03:00.762000", "created": "2026-01-28T02:28:18.037000", "tags": [ "32-bit", "elf", "mips", "Mozi", "ClearFake", "arm", "geofenced", "opendir", "ua-wget", "USA", "sparc", "mirai", "x86", "m68k", "PowerPC", "SuperH", "sh", "xml", "AsyncRAT", "c2-monitor-auto", "dropped-by-amadey", "64-bit", "gafgyt", "x86-64", "KongTuke", "exe", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit", "bat", "C2:198.23.177.196:2404", "GuLoader", "RemcosRAT", "3ffae72147348ef591eb32443902cb86", "jpg-base64-loader", "PhantomStealer", "XenoStealer", "fbf543", "gz", "tar", "tgz", "connectwise", "NLD", "powershell", "windows", "remcos" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 152, "domain": 2 }, "indicator_count": 154, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "51 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6996f882ac40b3170d89ebbe", "name": "Sticky trail: exploring the attacks of the PseudoSticky faction.", "description": "In November 2025, F6 experts uncovered a coordinated malicious campaign attributed to a group known as PseudoSticky. This operation revealed a comprehensive and sophisticated array of malware activities, demonstrating a clear link to the previously identified Sticky Werewolf threat actor. This connection was evident through shared tactics, techniques, and procedures (TTPs) as well as specific tools utilized in their operations, suggesting a collaboration or shared methodology between the two factions.\n\nIn January 2026, F6 analysts observed a shift in the PseudoSticky group's operational methods. Following the New Year holidays, the group altered its attack chain, indicating an evolution in their approach or objectives. While specific details regarding these changes are not provided, the adaptation signals a potential refinement in their tactics, which could be aimed at improving their success rates or broadening their target reach.", "modified": "2026-02-19T11:48:40.021000", "created": "2026-02-19T11:48:18.768000", "tags": [], "references": [ "https://www.f6.ru/blog/pseudo-sticky/?/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Energy", "Aerospace", "Education", "Transportation", "Retail" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "hostname": 2, "FileHash-MD5": 17, "FileHash-SHA1": 17, "FileHash-SHA256": 17, "URL": 4 }, "indicator_count": 59, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682928f8f9ff9f7194a51196", "name": "fake converters", "description": "", "modified": "2026-02-10T05:57:32.264000", "created": "2025-05-18T00:25:28.625000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 36, "URL": 132, "FileHash-MD5": 54, "FileHash-SHA1": 45, "FileHash-SHA256": 136, "domain": 77 }, "indicator_count": 480, "is_author": false, "is_subscribing": null, "subscriber_count": 177, "modified_text": "68 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69862c2e4b4ff157b012717d", "name": "PreCog Sweep - 2026-02-06 18h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T18:00:14.463000", "created": "2026-02-06T18:00:14.463000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698629d65d19c981f5fdaee1", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:50:14.270000", "created": "2026-02-06T17:50:14.270000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6986277e0648b84626ff06c1", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:40:14.874000", "created": "2026-02-06T17:40:14.874000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69862525ad89a5ea67ef4666", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:30:13.653000", "created": "2026-02-06T17:30:13.653000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698622cee1c1f1189db2cebf", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:20:14.170000", "created": "2026-02-06T17:20:14.170000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981914599badf8d9ef54fcf", "name": "PreCog Sweep - 2026-02-03 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-03T06:10:13.858000", "created": "2026-02-03T06:10:13.858000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 203, "domain": 295 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "75 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69805991034d3b507e09f580", "name": "PreCog Sweep - 2026-02-02 08h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T08:00:17.785000", "created": "2026-02-02T08:00:17.785000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 233, "URL": 49, "hostname": 131 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698057369ba6b4c643f21585", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:50:14.862000", "created": "2026-02-02T07:50:14.862000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 233, "URL": 49, "hostname": 131 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698054de8883208aa3c0d735", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:40:14.438000", "created": "2026-02-02T07:40:14.438000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 233, "URL": 49, "hostname": 131 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69805288a6a344665d1e71be", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:30:16.069000", "created": "2026-02-02T07:30:16.069000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 246, "hostname": 151, "URL": 16 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6980502ee60edfb57380f8a1", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:20:14.939000", "created": "2026-02-02T07:20:14.939000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 149, "URL": 19 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69804dd825676b17ba02ce49", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:10:16.308000", "created": "2026-02-02T07:10:16.308000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 149, "URL": 19 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69804b80e21a0a9f8d9bd99c", "name": "PreCog Sweep - 2026-02-02 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T07:00:16.459000", "created": "2026-02-02T07:00:16.459000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 149, "URL": 19 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69804925c2ebc968ad9af0a6", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:50:13.966000", "created": "2026-02-02T06:50:13.966000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 148, "URL": 19 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698046cdcaf95a16baa2accb", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:40:13.617000", "created": "2026-02-02T06:40:13.617000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 148, "URL": 19 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69804477faab71cd0421e024", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:30:15.475000", "created": "2026-02-02T06:30:15.475000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 244, "hostname": 149, "URL": 19 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6980421f7ac366c3e7c8cd35", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:20:15.085000", "created": "2026-02-02T06:20:15.085000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 242, "hostname": 147, "URL": 21 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69803fc73f25c5aacf281680", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:10:15.881000", "created": "2026-02-02T06:10:15.881000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 242, "hostname": 147, "URL": 21 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69803d704b86f37fc49c4468", "name": "PreCog Sweep - 2026-02-02 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T06:00:16.331000", "created": "2026-02-02T06:00:16.331000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69803b1651cc42e1143d101d", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:50:14.938000", "created": "2026-02-02T05:50:14.938000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698038be60f0b53f247a43a4", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:40:14.190000", "created": "2026-02-02T05:40:14.190000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69803668441d02b3834413a1", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:30:16.121000", "created": "2026-02-02T05:30:16.121000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6980340ea63b3c2fb705f8dc", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:20:14.033000", "created": "2026-02-02T05:20:14.033000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698031b62ad4a6e3f46541bb", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:10:14.336000", "created": "2026-02-02T05:10:14.336000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69802f5ffc1a69e9a428f2d5", "name": "PreCog Sweep - 2026-02-02 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T05:00:15.754000", "created": "2026-02-02T05:00:15.754000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 243, "hostname": 149 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69802d063cda827fbf689640", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:50:14.739000", "created": "2026-02-02T04:50:14.739000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 241, "hostname": 151 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69802aae551213afd26d0d8f", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:40:14.461000", "created": "2026-02-02T04:40:14.461000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 241, "hostname": 151 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698028563635effc299bea4c", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:30:14.615000", "created": "2026-02-02T04:30:14.615000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 241, "hostname": 151 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698025fd075bbff9a4d3db61", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:20:13.078000", "created": "2026-02-02T04:20:13.078000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 241, "hostname": 151 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698023a6b0d3a59fcdf9e220", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:10:14.665000", "created": "2026-02-02T04:10:14.665000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 241, "hostname": 151 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6980214e8e790280b72600f4", "name": "PreCog Sweep - 2026-02-02 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T04:00:13.979000", "created": "2026-02-02T04:00:13.979000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 152 }, "indicator_count": 412, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69801ef507eca86496e36a4b", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:50:13.458000", "created": "2026-02-02T03:50:13.458000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69801c9f1feffb66c2c71329", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:40:14.979000", "created": "2026-02-02T03:40:14.979000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69801a46dafe3ad2702f7fd1", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:30:14.124000", "created": "2026-02-02T03:30:14.124000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698017f1ba35592fb3bc7702", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:20:17.001000", "created": "2026-02-02T03:20:17.001000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6980159bbbbd5e209d6c8cde", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:10:19.035000", "created": "2026-02-02T03:10:19.035000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69801343a62376c0e6874afd", "name": "PreCog Sweep - 2026-02-02 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T03:00:19.220000", "created": "2026-02-02T03:00:19.220000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 19, "domain": 240, "hostname": 152 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698010e8d99ac39a84d20c1b", "name": "PreCog Sweep - 2026-02-02 02h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-02T02:50:16.359000", "created": "2026-02-02T02:50:16.359000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 240, "hostname": 151 }, "indicator_count": 411, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "76 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fb57f0477cf754ac675d4", "name": "PreCog Sweep - 2026-02-01 20h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T20:20:15.493000", "created": "2026-02-01T20:20:15.493000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 21, "domain": 70, "hostname": 141 }, "indicator_count": 232, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fb3266ce861b25679aaa1", "name": "PreCog Sweep - 2026-02-01 20h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T20:10:14.126000", "created": "2026-02-01T20:10:14.126000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 21, "domain": 70, "hostname": 141 }, "indicator_count": 232, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fb0cf61eafbeb4eed41cc", "name": "PreCog Sweep - 2026-02-01 20h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T20:00:15.078000", "created": "2026-02-01T20:00:15.078000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 20, "domain": 71, "hostname": 143 }, "indicator_count": 234, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fa9c501bcf060d820db04", "name": "PreCog Sweep - 2026-02-01 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T19:30:13.480000", "created": "2026-02-01T19:30:13.480000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 133, "domain": 81, "URL": 17 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fa76fcb60643601275548", "name": "PreCog Sweep - 2026-02-01 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T19:20:15.383000", "created": "2026-02-01T19:20:15.383000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 131, "URL": 17, "domain": 83 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fa515f33739018f7b4c64", "name": "PreCog Sweep - 2026-02-01 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T19:10:13.695000", "created": "2026-02-01T19:10:13.695000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 131, "URL": 17, "domain": 83 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697fa2c02f06218d23b4c39c", "name": "PreCog Sweep - 2026-02-01 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-01T19:00:16.357000", "created": "2026-02-01T19:00:16.357000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 130, "URL": 17, "domain": 84 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "77 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "IOCs.2026.csv", "https://analytics.dugganusa.com/api/v1/stix/master", "https://www.f6.ru/blog/pseudo-sticky/", "https://urlhaus.abuse.ch/browse/", "https://www.f6.ru/blog/pseudo-sticky/?/", "https://github.com/pduggusa/dugganusa-research" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "PseudoSticky", "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo" ], "malware_families": [], "industries": [ "Energy", "Education", "Transportation", "Retail", "Aerospace" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 50, "pulses": [ { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "19 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699a1693d2554dc119a0d38c", "name": "Sticky trail: exploring the attacks of the PseudoSticky faction", "description": "In November 2025, F6 experts uncovered a coordinated malicious campaign attributed to a group known as PseudoSticky. This operation revealed a comprehensive and sophisticated array of malware activities, demonstrating a clear link to the previously identified Sticky Werewolf threat actor. This connection was evident through shared tactics, techniques, and procedures (TTPs) as well as specific tools utilized in their operations, suggesting a collaboration or shared methodology between the two factions.\n\nBy December 2025, the PseudoSticky group escalated their operations, specifically through targeted phishing campaigns aimed at companies within the retail and construction sectors. This strategy highlighted the group's ability to adapt its social engineering tactics to appeal to specific industries, potentially leveraging seasonal themes for increased effectiveness, as suggested by the timing of their operations around the Christmas period.", "modified": "2026-03-23T20:05:30.881000", "created": "2026-02-21T20:33:23.145000", "tags": [ "strong", "temp", "pseudosticky", "darktrack", "sticky", "werewolf", "ttps", "sticky werewolf", "nsis", "pe32", "remcos", "purecrypter", "f6" ], "references": [ "https://www.f6.ru/blog/pseudo-sticky/" ], "public": 1, "adversary": "PseudoSticky", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1137", "name": "Office Application Startup", "display_name": "T1137 - Office Application Startup" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "hostname": 2, "FileHash-MD5": 21, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 7 }, "indicator_count": 70, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "697974428ee6adba0849b139", "name": "URLHaus data - 27-01-2026 (Part 2)", "description": "", "modified": "2026-02-27T02:03:00.762000", "created": "2026-01-28T02:28:18.037000", "tags": [ "32-bit", "elf", "mips", "Mozi", "ClearFake", "arm", "geofenced", "opendir", "ua-wget", "USA", "sparc", "mirai", "x86", "m68k", "PowerPC", "SuperH", "sh", "xml", "AsyncRAT", "c2-monitor-auto", "dropped-by-amadey", "64-bit", "gafgyt", "x86-64", "KongTuke", "exe", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit", "bat", "C2:198.23.177.196:2404", "GuLoader", "RemcosRAT", "3ffae72147348ef591eb32443902cb86", "jpg-base64-loader", "PhantomStealer", "XenoStealer", "fbf543", "gz", "tar", "tgz", "connectwise", "NLD", "powershell", "windows", "remcos" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 152, "domain": 2 }, "indicator_count": 154, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "51 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6996f882ac40b3170d89ebbe", "name": "Sticky trail: exploring the attacks of the PseudoSticky faction.", "description": "In November 2025, F6 experts uncovered a coordinated malicious campaign attributed to a group known as PseudoSticky. This operation revealed a comprehensive and sophisticated array of malware activities, demonstrating a clear link to the previously identified Sticky Werewolf threat actor. This connection was evident through shared tactics, techniques, and procedures (TTPs) as well as specific tools utilized in their operations, suggesting a collaboration or shared methodology between the two factions.\n\nIn January 2026, F6 analysts observed a shift in the PseudoSticky group's operational methods. Following the New Year holidays, the group altered its attack chain, indicating an evolution in their approach or objectives. While specific details regarding these changes are not provided, the adaptation signals a potential refinement in their tactics, which could be aimed at improving their success rates or broadening their target reach.", "modified": "2026-02-19T11:48:40.021000", "created": "2026-02-19T11:48:18.768000", "tags": [], "references": [ "https://www.f6.ru/blog/pseudo-sticky/?/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Energy", "Aerospace", "Education", "Transportation", "Retail" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "hostname": 2, "FileHash-MD5": 17, "FileHash-SHA1": 17, "FileHash-SHA256": 17, "URL": 4 }, "indicator_count": 59, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682928f8f9ff9f7194a51196", "name": "fake converters", "description": "", "modified": "2026-02-10T05:57:32.264000", "created": "2025-05-18T00:25:28.625000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 36, "URL": 132, "FileHash-MD5": 54, "FileHash-SHA1": 45, "FileHash-SHA256": 136, "domain": 77 }, "indicator_count": 480, "is_author": false, "is_subscribing": null, "subscriber_count": 177, "modified_text": "68 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69862c2e4b4ff157b012717d", "name": "PreCog Sweep - 2026-02-06 18h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T18:00:14.463000", "created": "2026-02-06T18:00:14.463000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698629d65d19c981f5fdaee1", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:50:14.270000", "created": "2026-02-06T17:50:14.270000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6986277e0648b84626ff06c1", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:40:14.874000", "created": "2026-02-06T17:40:14.874000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69862525ad89a5ea67ef4666", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:30:13.653000", "created": "2026-02-06T17:30:13.653000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698622cee1c1f1189db2cebf", "name": "PreCog Sweep - 2026-02-06 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-02-06T17:20:14.170000", "created": "2026-02-06T17:20:14.170000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 191, "domain": 307 }, "indicator_count": 498, "is_author": false, "is_subscribing": null, "subscriber_count": 170, "modified_text": "72 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "bashupload.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "bashupload.com", "found": true, "verdict": "malicious", "url_count": 11, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://bashupload.com/Daerjg.exe", "status": "offline", "threat": "malware_download", "date_added": "2026-01-27", "tags": [ "exe", "remcos" ] }, { "url": "https://bashupload.com/XzByv/BTC_FLASH.exe", "status": "offline", "threat": "malware_download", "date_added": "2025-08-14", "tags": [ "c2-monitor-auto", "dropped-by-amadey" ] }, { "url": "https://bashupload.com/FmJPs/fuck12312.exe?download=1", "status": "offline", "threat": "malware_download", "date_added": "2025-05-27", "tags": [ "c2-monitor-auto", "dropped-by-amadey" ] }, { "url": "https://bashupload.com/2-b4b/cron1.exe?download=1", "status": "offline", "threat": "malware_download", "date_added": "2025-05-27", "tags": [ "c2-monitor-auto", "dropped-by-amadey" ] }, { "url": "https://bashupload.com/uKjXo/cron2.exe?download=1", "status": "offline", "threat": "malware_download", "date_added": "2025-05-27", "tags": [ "c2-monitor-auto", "dropped-by-amadey" ] }, { "url": "http://bashupload.com/drtvo/share.zip", "status": "offline", "threat": "malware_download", "date_added": "2024-07-07", "tags": [ "zip" ] }, { "url": "https://bashupload.com/19MfJ/UZTlo.exe?download=1", "status": "offline", "threat": "malware_download", "date_added": "2024-03-28", "tags": [ "dropped-by-SmokeLoader" ] }, { "url": "https://bashupload.com/SCG4L/Aphmau.c", "status": "offline", "threat": "malware_download", "date_added": "2023-04-21", "tags": [ "MBR" ] }, { "url": "http://bashupload.com/kYk2M/girl.jpg", "status": "offline", "threat": "malware_download", "date_added": "2023-04-21", "tags": [] }, { "url": "https://bashupload.com/YM_Km/Sites.txt", "status": "offline", "threat": "malware_download", "date_added": "2023-04-21", "tags": [] } ], "error": null }, "from_cache": true, "_cached_at": 1776645510.8665793 }