{ "type": "Domain", "indicator": "captcha.bot", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/captcha.bot", "alexa": "http://www.alexa.com/siteinfo/captcha.bot", "indicator": "captcha.bot", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3351101270, "indicator": "captcha.bot", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 49, "pulses": [ { "id": "6913e168fd82ca941c82ed7f", "name": "InQuest - 11-11-2025", "description": "", "modified": "2025-12-12T01:00:21.615000", "created": "2025-11-12T01:22:48.439000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1627, "modified_text": "171 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69128f3da66a3142f2018f5b", "name": "InQuest - 10-11-2025", "description": "", "modified": "2025-12-11T01:00:08.056000", "created": "2025-11-11T01:19:57.422000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "172 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69113f39a1836c5e9d4dfa75", "name": "InQuest - 09-11-2025", "description": "", "modified": "2025-12-10T01:04:09.054000", "created": "2025-11-10T01:26:17.257000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "173 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690fee42d46e57498499085e", "name": "InQuest - 08-11-2025", "description": "", "modified": "2025-12-09T01:03:09.068000", "created": "2025-11-09T01:28:34.874000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690e9ed3322f4f24750109ad", "name": "InQuest - 07-11-2025", "description": "", "modified": "2025-12-08T01:03:47.101000", "created": "2025-11-08T01:37:23.724000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "175 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690d48e1f96e164faf4d4481", "name": "InQuest - 06-11-2025", "description": "", "modified": "2025-12-07T01:02:10.610000", "created": "2025-11-07T01:18:25.096000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690bf8f336de410356c9e902", "name": "InQuest - 05-11-2025", "description": "", "modified": "2025-12-06T01:05:09.974000", "created": "2025-11-06T01:25:07.394000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "177 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6906b911e31730aaa7497931", "name": "InQuest - 01-11-2025", "description": "", "modified": "2025-12-02T01:05:30.331000", "created": "2025-11-02T01:51:13.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "181 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6905669c366b8c51da7b4fa3", "name": "InQuest - 31-10-2025", "description": "", "modified": "2025-12-01T01:04:29.571000", "created": "2025-11-01T01:47:08.128000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "182 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69040f6c829b6e3f4018a5df", "name": "InQuest - 30-10-2025", "description": "", "modified": "2025-11-30T01:06:08.235000", "created": "2025-10-31T01:22:52.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "183 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6902bd8a4a93702ee86f9e6f", "name": "InQuest - 29-10-2025", "description": "", "modified": "2025-11-29T01:00:13.628000", "created": "2025-10-30T01:21:14.934000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "184 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69016c26e6acc925421729e7", "name": "InQuest - 28-10-2025", "description": "", "modified": "2025-11-28T01:01:19.760000", "created": "2025-10-29T01:21:42.428000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "185 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69001b1f08a8353ff6565cc4", "name": "InQuest - 27-10-2025", "description": "", "modified": "2025-11-27T01:01:22.898000", "created": "2025-10-28T01:23:43.357000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "186 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68fec6a19f06413ffcd28c41", "name": "InQuest - 26-10-2025", "description": "", "modified": "2025-11-26T01:00:30.420000", "created": "2025-10-27T01:10:57.123000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "187 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68fd65dd72b114e463bc1927", "name": "InQuest - 25-10-2025", "description": "", "modified": "2025-11-25T00:03:22.543000", "created": "2025-10-26T00:05:49.395000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "188 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68fc1c1b1e8aab75d27c6ace", "name": "InQuest - 24-10-2025", "description": "", "modified": "2025-11-24T00:03:55.362000", "created": "2025-10-25T00:38:51.397000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "189 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68fac33f72c7237d3680c2a9", "name": "InQuest - 23-10-2025", "description": "", "modified": "2025-11-23T00:04:46.427000", "created": "2025-10-24T00:07:26.392000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "190 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f974e9c52dee6ef1dc4402", "name": "InQuest - 22-10-2025", "description": "", "modified": "2025-11-22T00:01:42.464000", "created": "2025-10-23T00:20:57.351000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "191 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f822c83a9eaa04095f3c34", "name": "InQuest - 21-10-2025", "description": "", "modified": "2025-11-21T00:00:54.614000", "created": "2025-10-22T00:18:16.679000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "192 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f6d1b0dc049d393f39a6c9", "name": "InQuest - 20-10-2025", "description": "", "modified": "2025-11-20T00:02:20.508000", "created": "2025-10-21T00:20:00.737000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "193 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f57e3f6801991ab7bb6064", "name": "InQuest - 19-10-2025", "description": "", "modified": "2025-11-19T00:02:49.008000", "created": "2025-10-20T00:11:43.459000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "194 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f42b8a6d4aa48bfa787786", "name": "InQuest - 18-10-2025", "description": "", "modified": "2025-11-18T00:03:59.309000", "created": "2025-10-19T00:06:34.950000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "195 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f187d2475f95527737f7ec", "name": "InQuest - 16-10-2025", "description": "", "modified": "2025-11-16T00:04:22.390000", "created": "2025-10-17T00:03:30.943000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f037b80365dd89d54f8c05", "name": "InQuest - 15-10-2025", "description": "", "modified": "2025-11-15T00:02:40.652000", "created": "2025-10-16T00:09:28.812000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68eee5e57599a5c49785be3d", "name": "InQuest - 14-10-2025", "description": "", "modified": "2025-11-14T00:04:17.128000", "created": "2025-10-15T00:08:00.404000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "199 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68ed93f252587a171a47e4c5", "name": "InQuest - 13-10-2025", "description": "", "modified": "2025-11-13T00:02:21.655000", "created": "2025-10-14T00:06:10.277000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "200 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68ec43cbc0d87339579fe7c9", "name": "InQuest - 12-10-2025", "description": "", "modified": "2025-11-12T00:05:30.355000", "created": "2025-10-13T00:11:55.937000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "201 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68eaf163815769ec957ba8f3", "name": "InQuest - 11-10-2025", "description": "", "modified": "2025-11-11T00:00:14.461000", "created": "2025-10-12T00:08:03.662000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "202 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e9a3399b31eb41103f6f51", "name": "InQuest - 10-10-2025", "description": "", "modified": "2025-11-10T00:05:06.737000", "created": "2025-10-11T00:22:17.558000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "203 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e850618851fd713543d7ab", "name": "InQuest - 09-10-2025", "description": "", "modified": "2025-11-09T00:03:01.593000", "created": "2025-10-10T00:16:33.095000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 98, "URL": 529, "FileHash-SHA1": 47, "FileHash-SHA256": 261, "domain": 115, "FileHash-MD5": 71 }, "indicator_count": 1121, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "204 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e7013824bb244891cdfca2", "name": "InQuest - 08-10-2025", "description": "", "modified": "2025-11-08T00:01:01.095000", "created": "2025-10-09T00:26:32.852000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "205 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e5acdb3bbe2dd71d66813a", "name": "InQuest - 07-10-2025", "description": "", "modified": "2025-11-07T00:02:42.967000", "created": "2025-10-08T00:14:19.336000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 90, "URL": 479, "FileHash-SHA1": 53, "FileHash-SHA256": 229, "domain": 101, "FileHash-MD5": 69 }, "indicator_count": 1021, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "206 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e45b87ebdecbf9ac69e2a7", "name": "InQuest - 06-10-2025", "description": "", "modified": "2025-11-06T00:00:27.507000", "created": "2025-10-07T00:15:03.324000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e309ab8f26b5c5a1e91462", "name": "InQuest - 05-10-2025", "description": "", "modified": "2025-11-05T00:01:35.296000", "created": "2025-10-06T00:13:31.479000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "208 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e1b7832e7490c095c925ff", "name": "InQuest - 04-10-2025", "description": "", "modified": "2025-11-04T00:03:30.889000", "created": "2025-10-05T00:10:43.068000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 123, "URL": 486, "FileHash-SHA256": 325, "FileHash-SHA1": 41, "domain": 107, "FileHash-MD5": 66 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e06a9390301bf811e48a83", "name": "InQuest - 03-10-2025", "description": "", "modified": "2025-11-03T00:00:29.534000", "created": "2025-10-04T00:30:11.168000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "210 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68df13216f406db07fa7a7a3", "name": "InQuest - 02-10-2025", "description": "", "modified": "2025-11-02T00:03:02.474000", "created": "2025-10-03T00:04:49.343000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 526, "domain": 125, "FileHash-SHA1": 49, "FileHash-SHA256": 279, "FileHash-MD5": 70 }, "indicator_count": 1146, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "211 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68ddc1987cc6e92676d40479", "name": "InQuest - 01-10-2025", "description": "", "modified": "2025-11-01T00:02:59.726000", "created": "2025-10-02T00:04:40.205000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "212 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68dc723f00e1f6e1fecc4e6e", "name": "InQuest - 30-09-2025", "description": "", "modified": "2025-10-31T00:03:36.521000", "created": "2025-10-01T00:13:51.581000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "213 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68db1f4319e6109b961ad87c", "name": "InQuest - 29-09-2025", "description": "", "modified": "2025-10-30T00:02:15.510000", "created": "2025-09-30T00:07:31.114000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 113, "URL": 456, "FileHash-SHA1": 41, "FileHash-SHA256": 278, "domain": 100, "FileHash-MD5": 53 }, "indicator_count": 1041, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "214 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d9cd9372fa92abfaabf720", "name": "InQuest - 28-09-2025", "description": "", "modified": "2025-10-29T00:04:41.122000", "created": "2025-09-29T00:06:43.137000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 94, "URL": 524, "domain": 114, "FileHash-SHA1": 47, "FileHash-SHA256": 223, "FileHash-MD5": 71 }, "indicator_count": 1073, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "215 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d87dbb65843acc15935391", "name": "InQuest - 27-09-2025", "description": "", "modified": "2025-10-28T00:00:01.953000", "created": "2025-09-28T00:13:47.657000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d7d8ee2caff74a1759380a", "name": "Quasar - DiabloFans.com ( packed) how a YouTube follow turned into a 12 year campaign of fear & intimidation", "description": "Packed with malware, rats, droppers, bots, info stealers diablofans.com matches targets description of how attack began in 10.2013. Egregious patient abuse led national medical corporation and / or quasi entity involved to attack / silence victim. Within 48 hours of disclosure\nof events causing victim to stop treating a Guy Fawkes profile with satanic name became\nvictims YouTube follower beginning 12 year + cyber warfare attack against crime victim. Overseeing MD prompted an investigation, told target she would be targeted and to hide. The website appears to be a front for very malicious activities. Several network attack began a destructive campaign against target. Many attacks and websites , parking crews involved. All tags auto populated. Many fear tactics & attempts. . | Description: For years, DiabloFans served as a major community hub for discussing Diablo III, posting news, and sharing character builds. (shutdown? sold to curse.llc?)", "modified": "2025-10-27T11:02:05.642000", "created": "2025-09-27T12:30:38.161000", "tags": [ "diablo", "builds", "sanctuary", "season", "diablo immortal", "forums", "interactive map", "diablo iii", "environ", "trier par", "hunt", "chaos", "altar", "facebook", "hunter", "data redacted", "server", "registrar abuse", "registrant fax", "contact phone", "registrar url", "admin city", "admin country", "record type", "ttl value", "thumbprint", "gandi sas", "gandi", "cloudflare", "span", "pattern match", "getprocaddress", "script", "found https", "path", "ck id", "magic", "life", "astaroth", "damage", "meta", "lucky", "open", "footer", "ladder", "rogue", "iframe", "title", "hell", "blizzard", "fear", "class", "nightmare", "june", "comment", "reload", "twitch", "hawk", "hydra", "energy", "school", "pass", "beast", "maker", "corpse", "chat", "hatred", "critical", "mephisto", "back", "form", "druid", "shadow", "scoundrel", "core", "stone", "freeze", "light", "speed", "poison", "conduit", "charm", "lightning", "close", "fury", "steam", "blast", "raven", "wave", "horn", "team", "knight", "elite", "warp", "premium", "realm", "skull", "general", "tracker", "arcane", "basilisk", "prayer", "black", "soul", "saboteur", "bone", "exploit", "carnage", "hellspawn", "ultimate", "spark", "slow", "frozen", "immortal", "feast", "entropy", "crazy", "dead", "heat", "explosive", "blaze", "solar", "harmony", "attack", "stealth", "shell", "mother", "overkill", "rage", "werewolf", "service", "anomaly", "drop", "eclipse", "android", "wind", "spirit", "face", "fractured", "pandora", "strange", "demon", "eternal", "crystal", "cold", "false", "window", "format", "click", "strings", "comi", "sector", "learn", "adversaries", "calls", "name tactics", "suspicious", "informative", "defense evasion", "reads", "command", "model", "stop", "spawns", "development att", "flag", "name server", "canada canada", "united", "enom", "redacted for", "privacy name", "organization", "script urls", "name servers", "a domains", "emails", "unknown ns", "sweet heart", "sec ch", "media", "encrypt", "passive dns", "next associated", "ipv4 add", "urls", "files", "hosting", "reverse dns", "dynamicloader", "high", "medium", "windows", "displayname", "tofsee", "yara rule", "loaderid", "startsrv", "lidfileupd", "stream", "port", "destination", "win64", "write", "malware", "ip address", "domain", "hostname add", "search", "packing t1045", "module load", "delete", "write c", "trojan", "win32", "next", "dns query", "icmp traffic", "moved", "servers", "germany unknown", "present mar", "accept", "gmt content", "a li", "main", "error", "lowfi", "present aug", "present sep", "present jul", "unknown aaaa", "record value", "content type", "htm align", "param", "gmt server", "france", "france unknown", "url analysis", "location france", "langchinese", "rticon", "pe resource", "t1045", "ascii text", "cape", "delete c", "redline malware", "guard", "redline", "defender", "push", "backdoor", "present apr", "trojandropper", "dns resolutions", "smoke loader", "hacktool", "windows auto", "attempts", "explorer", "win32autoit mar", "location united", "ip whois", "verdict", "entries", "aaaa", "domain add", "present feb", "present oct", "users", "yara detections", "recycle bin", "pe section", "as54113", "read", "copy", "ufffduf1a3", "looks", "xrat1", "quasar", "powershell", "code", "ids detections", "tls sni", "contacted", "installs", "checks", "windows startup", "vendor finding", "notes clamav", "files matching", "number", "http request", "post", "url host", "port method", "user agent", "internalsapiip", "okrnserver", "ubuntu", "hash", "alerts", "present jun", "mtb jun", "date", "cname", "creation date", "ukraine" ], "references": [ "DiabloFans.com", "Every tag OTC auto populated . Crazy talk. Please see Mitre ATT&CK", "twitter.com \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 www.pornhub.com \u2022 oriental-porno.lat", "https://pin.it/ \u2022 pin.it a fake Pinterest for Tsara Brashears", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \u2022 wallpapers-nature.com", "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language:", "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language", "http://www.sweetheartvideo.com/tsara-brashears \u2022 https://www.sweetheartvideo.com/tsara-brashears", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing \u2022 www.anyxxxtube.net", "init.ess.apple.com \u2022otc.greatcall.com (phone manipulators) \u2022 mailtrack.io \u2022 https://trackacourier.net", "https://www.youtube-nocookie.com/embed/6w5ukhqvtmq", "https://www.youtube.com \u2022 https://www.youtube.com/user/CurseDiablofans", "https://www.youtube-nocookie.com/embed/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win32:CrypterX-gen\\ [Trj]", "display_name": "Win32:CrypterX-gen\\ [Trj]", "target": null }, { "id": "ALF:Trojan:Win32/VTFlooder", "display_name": "ALF:Trojan:Win32/VTFlooder", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Smoke Loader", "display_name": "Smoke Loader", "target": null }, { "id": "Win.Dropper.Vbclone-10036195-0", "display_name": "Win.Dropper.Vbclone-10036195-0", "target": null }, { "id": "ALF:HeraklezEval:Worm:Win32/Vobfus", "display_name": "ALF:HeraklezEval:Worm:Win32/Vobfus", "target": null }, { "id": "Trojan:Win32/Danabot", "display_name": "Trojan:Win32/Danabot", "target": "/malware/Trojan:Win32/Danabot" }, { "id": "ALF:Trojan:Win32/G3nasom!imp", "display_name": "ALF:Trojan:Win32/G3nasom!imp", "target": null }, { "id": "Unidentified 083 (AutoIT Stealer)", "display_name": "Unidentified 083 (AutoIT Stealer)", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null } ], "attack_ids": [ { "id": "T1007", "name": "System Service Discovery", "display_name": "T1007 - System Service Discovery" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1201", "name": "Password Policy Discovery", "display_name": "T1201 - Password Policy Discovery" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1585.001", "name": "Social Media Accounts", "display_name": "T1585.001 - Social Media Accounts" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 656, "FileHash-SHA256": 2354, "hostname": 499, "URL": 1319, "email": 21, "FileHash-MD5": 766, "FileHash-SHA1": 748, "SSLCertFingerprint": 10 }, "indicator_count": 6373, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d72cfe0033dd3e7b2ce681", "name": "InQuest - 26-09-2025", "description": "", "modified": "2025-10-27T00:02:55.235000", "created": "2025-09-27T00:17:02.862000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 426, "FileHash-SHA1": 42, "FileHash-SHA256": 262, "domain": 94, "FileHash-MD5": 58 }, "indicator_count": 979, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "217 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d5dab4fe48bd21a0a7e19a", "name": "InQuest - 25-09-2025", "description": "", "modified": "2025-10-26T00:00:42.726000", "created": "2025-09-26T00:13:40.945000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "218 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688ef0516013ca78448bf4e5", "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary", "description": "Foundry ? Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber & Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose. Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?", "modified": "2025-09-02T04:01:31.218000", "created": "2025-08-03T05:14:57.402000", "tags": [ "united", "moved", "entries", "passive dns", "detected m1", "next associated", "mtb apr", "mtb aug", "server", "gmt content", "trojandropper", "trojan", "body", "lokibot request", "c2 commands", "detected m2", "otx telemetry", "historical otx", "twitter running", "open ports", "cves", "time", "dynamicloader", "port", "search", "show", "destination", "alerts", "copy", "dynamic", "medium", "write", "creation date", "hostmaster", "urls", "domain", "showing", "hostname add", "pulse pulses", "date", "flag", "falcon sandbox", "name server", "markmonitor", "analysis", "mitre att", "anonymous", "upgrade", "hybrid", "contact", "usa windows", "december", "input threat", "level analysis", "summary", "february", "hwp support", "january", "october", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "calls", "command", "javascript", "object model", "model", "windir", "json data", "localappdata", "ascii text", "temp", "getprocaddress", "script", "license", "runtime process", "copy md5", "facebook", "roboto", "error", "win64", "path", "blink", "meta", "factory", "general", "comspec", "click", "strings", "damage", "mini", "stop", "core", "expl", "win32", "gmt server", "ecacc saa83dd", "ipv4 add", "twitter", "cobalt strike", "mozilla" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 263, "FileHash-SHA1": 256, "FileHash-SHA256": 837, "hostname": 4415, "URL": 1918, "domain": 1884, "email": 2, "SSLCertFingerprint": 2 }, "indicator_count": 9577, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "271 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6883e10bf1c0e45b010f05fb", "name": "Hackers Use Weaponized .HTA Files to Infect Victims with Red Ransomware", "description": "", "modified": "2025-08-24T19:00:06.864000", "created": "2025-07-25T19:54:51.930000", "tags": [ "july", "cyber security", "strong", "aman mishra", "linkedin", "epsilon red", "windows", "follow", "google news", "instant updates", "red ransomware", "twitter", "shell", "quasar rat", "june", "beware", "friday", "twitch", "impact", "revil", "attack", "teamviewer" ], "references": [ "https://gbhackers.com/hackers-use-weaponized-hta-files-to-infect-victims/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 2, "domain": 3 }, "indicator_count": 9, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "280 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6883b70256afcd0dd4c7420a", "name": "Threat Actors Lure Victims Into Downloading .HTA Files Using ClickFix To Spread Epsilon Red Ransomware | CloudSEK", "description": "During routine infrastructure hunting, CloudSEK\u2019s TRIAD uncovered a Clickfix-themed malware delivery site in active development, associated with the Epsilon Red ransomware. Unlike previous campaigns that copy commands to clipboards, this variant urges victims to visit a secondary page, where malicious shell commands are silently executed via ActiveX to download and run payloads from an attacker-controlled IP. Social engineering tactics, such as fake verification codes, are used to appear benign. Pivoting into related infrastructure revealed impersonation of services like Discord Captcha Bot, Kick, Twitch, and OnlyFans, as well as romance-themed lures. Epsilon Red was first observed in 2021 and is loosely inspired by REvil ransomware in ransom note styling, but otherwise appears distinct in its tactics and infrastructure.", "modified": "2025-08-24T15:01:15.810000", "created": "2025-07-25T16:55:30.924000", "tags": [ "epsilon red", "command", "twitch", "activexobject", "activex", "kick", "onlyfans", "clickfix", "defense evasion", "summaryduring", "download", "red ransomware", "shell", "persistence", "ransomware", "quasar rat", "discord" ], "references": [ "https://www.cloudsek.com/blog/threat-actors-lure-victims-into-downloading-hta-files-using-clickfix-to-spread-epsilon-red-ransomware" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Epsilon Red Ransomware", "display_name": "Epsilon Red Ransomware", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "asubedi7", "id": "285027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 4, "domain": 3 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "280 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "687b5499d48de6e54f3bff11", "name": "213.174.130.70 - Spyware Install | Emotet via Malware sites", "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets", "modified": "2025-08-18T08:00:43.712000", "created": "2025-07-19T08:17:29.443000", "tags": [ "handle", "ripe ncc", "ripe network", "address range", "cidr", "allocation type", "assigned pa", "status", "whois server", "entity ah36ripe", "algorithm", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "date", "abuse contact", "orgid", "orgtechhandle", "address", "orgabuseref", "postalcode", "ripe", "seen", "update date", "tech email", "admin country", "expiration date", "dnssec", "admin id", "mi11255597wp", "msie", "chrome", "passive dns", "united", "ipv4 add", "pulse submit", "url analysis", "urls", "files", "hosting", "open", "body", "extraction", "data upload", "failed", "include review", "anorexx", "video", "father sex", "ebony riding", "ebony", "roberta", "type win32", "exe size", "mb first", "file name", "sentinelone", "present jul", "present oct", "entries http", "memcommit", "t1055", "read c", "search", "entries", "show", "medium", "showing", "high process", "injection t1055", "copy", "write", "win32", "malware", "tsara brashears", "tsara", "pornhub", "porn videos", "watch tsara", "most relevant", "open threat", "exchange", "public", "https", "green", "daily", "brashears", "porn", "watch", "busty xxx", "filter tsara", "brashears porn", "url add", "pulse pulses", "http", "related pulses", "none related", "tags none", "file type", "md5 sha256", "google safe", "browsing", "dynamicloader", "dynamic", "read", "delete", "mtb apr", "trojan", "lowfi", "virtool", "icloader apr", "otx telemetry", "australia", "exploit", "cobalt strike", "hostile", "trojanspy", "msil", "win64", "pulse", "alerts", "yara rule", "named pipe", "xe7xf3xf2x14x9d", "high", "delphi", "local", "next", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "defense evasion", "adversaries", "spawns", "found", "process details", "flag", "contacted", "meta", "location united", "copy md5", "copy sha1", "copy sha256", "sha256", "sha1", "size", "beginstring", "null", "type data", "error", "span", "hybrid", "general", "click", "strings", "refresh", "tools", "pattern match", "show technique", "mitre att", "ck matrix", "ascii text", "show process", "utf8", "crlf line", "network traffic", "path", "included", "review", "excludea", "sugges data", "typ url", "url url", "url hos", "hos hos", "extraction f", "enter so", "u extractio", "extra data", "included review", "ic excluded", "suggeste", "pulses", "md5 google", "safe browsing", "virustotal api", "comments", "ally s", "extraction data", "enter soudcfidi", "ad temdac", "cddad ad", "praw type", "extr", "include u", "creation date", "record value", "gmt content", "x adblock", "certificate", "domain", "encrypt", "sec ch", "ch ua", "unknown aaaa", "ua full", "ua platform", "present jun", "moved", "ip address", "doctype html", "lander script", "head", "method", "allowed date", "arizona", "scottsdale", "go daddy", "authority", "next associated", "extraction fail", "enter soupce", "udi ad", "trydda dada", "panca type", "ur extraction", "s data", "pr extract", "servers", "hostname", "files ip", "denmark unknown" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 4, "URL": 7528, "domain": 1822, "hostname": 2015, "email": 5, "FileHash-MD5": 373, "FileHash-SHA1": 363, "FileHash-SHA256": 1939 }, "indicator_count": 14049, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "286 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.youtube-nocookie.com/embed/", "http://www.sweetheartvideo.com/tsara-brashears \u2022 https://www.sweetheartvideo.com/tsara-brashears", "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language", "Every tag OTC auto populated . Crazy talk. Please see Mitre ATT&CK", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://pin.it/ \u2022 pin.it a fake Pinterest for Tsara Brashears", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "twitter.com \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 www.pornhub.com \u2022 oriental-porno.lat", "https://www.youtube.com \u2022 https://www.youtube.com/user/CurseDiablofans", "https://labs.inquest.net/iocdb", "https://gbhackers.com/hackers-use-weaponized-hta-files-to-infect-victims/", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language:", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \u2022 wallpapers-nature.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing \u2022 www.anyxxxtube.net", "https://www.cloudsek.com/blog/threat-actors-lure-victims-into-downloading-hta-files-using-clickfix-to-spread-epsilon-red-ransomware", "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com", "init.ess.apple.com \u2022otc.greatcall.com (phone manipulators) \u2022 mailtrack.io \u2022 https://trackacourier.net", "DiabloFans.com", "https://www.youtube-nocookie.com/embed/6w5ukhqvtmq" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Unidentified 083 (autoit stealer)", "Win32:crypterx-gen\\ [trj]", "Quasar", "Tofsee", "Alf:trojan:win32/vtflooder", "Alf:heraklezeval:worm:win32/vobfus", "Win.dropper.vbclone-10036195-0", "Trojan:win32/glupteba.mt!mtb", "Alf:trojan:win32/g3nasom!imp", "Epsilon red ransomware", "Hacktool", "Trojan:win32/danabot", "Smoke loader" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 49, "pulses": [ { "id": "6913e168fd82ca941c82ed7f", "name": "InQuest - 11-11-2025", "description": "", "modified": "2025-12-12T01:00:21.615000", "created": "2025-11-12T01:22:48.439000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1627, "modified_text": "171 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69128f3da66a3142f2018f5b", "name": "InQuest - 10-11-2025", "description": "", "modified": "2025-12-11T01:00:08.056000", "created": "2025-11-11T01:19:57.422000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "172 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69113f39a1836c5e9d4dfa75", "name": "InQuest - 09-11-2025", "description": "", "modified": "2025-12-10T01:04:09.054000", "created": "2025-11-10T01:26:17.257000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "173 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690fee42d46e57498499085e", "name": "InQuest - 08-11-2025", "description": "", "modified": "2025-12-09T01:03:09.068000", "created": "2025-11-09T01:28:34.874000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690e9ed3322f4f24750109ad", "name": "InQuest - 07-11-2025", "description": "", "modified": "2025-12-08T01:03:47.101000", "created": "2025-11-08T01:37:23.724000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "175 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690d48e1f96e164faf4d4481", "name": "InQuest - 06-11-2025", "description": "", "modified": "2025-12-07T01:02:10.610000", "created": "2025-11-07T01:18:25.096000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690bf8f336de410356c9e902", "name": "InQuest - 05-11-2025", "description": "", "modified": "2025-12-06T01:05:09.974000", "created": "2025-11-06T01:25:07.394000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "177 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6906b911e31730aaa7497931", "name": "InQuest - 01-11-2025", "description": "", "modified": "2025-12-02T01:05:30.331000", "created": "2025-11-02T01:51:13.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "181 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6905669c366b8c51da7b4fa3", "name": "InQuest - 31-10-2025", "description": "", "modified": "2025-12-01T01:04:29.571000", "created": "2025-11-01T01:47:08.128000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "182 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69040f6c829b6e3f4018a5df", "name": "InQuest - 30-10-2025", "description": "", "modified": "2025-11-30T01:06:08.235000", "created": "2025-10-31T01:22:52.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "183 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "captcha.bot", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "captcha.bot", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780276452.7293532 }