{ "type": "Domain", "indicator": "captcha123.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/captcha123.com", "alexa": "http://www.alexa.com/siteinfo/captcha123.com", "indicator": "captcha123.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4071900998, "indicator": "captcha123.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "6839b9fda32927ffee06576a", "name": "mixing", "description": "", "modified": "2026-01-10T04:25:54.397000", "created": "2025-05-30T14:00:29.942000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 368, "FileHash-MD5": 42, "FileHash-SHA1": 94, "FileHash-SHA256": 106, "domain": 302, "hostname": 27 }, "indicator_count": 939, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "142 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683a4b2a69251b5f532b1a72", "name": "URLHaus data - 30-05-2025", "description": "", "modified": "2025-06-30T00:00:28.480000", "created": "2025-05-31T00:19:54.776000", "tags": [ "elf", "ua-wget", "ascii", "powershell", "ps1", "opendir", "RemcosRAT", "AsyncRAT", "rat", "wshrat", "exe", "Encoded", "njRAT", "NanoCore", "AveMariaRAT", "xworm", "Formbook", "MassLogger", "LummaStealer", "donutloader", "connectwise", "HijackLoader", "encrypted", "GuLoader", "mirai", "rev-base64-loader", "DarkCloud", "VIPKeylogger", "python", "stealer", "Emmenhtal", "lnk", "DynamicStealer", "sh", "screenconnect", "gafgyt", "geofenced", "HKG", "IND", "TUR", "apk", "jar", "AgentTesla", "BABADEDA", "phorpiex", "Metasploit", "Cobalt strike", "jpg-base64-loader", "Amadey", "SharkStealer", "blight", "botnet", "ddos", "iot botnet", "malware", "censys", "CobaltStrike", "booking", "ClickFix", "dcrat", "FakeCaptcha", "xml-opendir", "hajime", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 70, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 256, "domain": 15, "hostname": 10 }, "indicator_count": 281, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "336 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "6839b9fda32927ffee06576a", "name": "mixing", "description": "", "modified": "2026-01-10T04:25:54.397000", "created": "2025-05-30T14:00:29.942000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 368, "FileHash-MD5": 42, "FileHash-SHA1": 94, "FileHash-SHA256": 106, "domain": 302, "hostname": 27 }, "indicator_count": 939, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "142 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683a4b2a69251b5f532b1a72", "name": "URLHaus data - 30-05-2025", "description": "", "modified": "2025-06-30T00:00:28.480000", "created": "2025-05-31T00:19:54.776000", "tags": [ "elf", "ua-wget", "ascii", "powershell", "ps1", "opendir", "RemcosRAT", "AsyncRAT", "rat", "wshrat", "exe", "Encoded", "njRAT", "NanoCore", "AveMariaRAT", "xworm", "Formbook", "MassLogger", "LummaStealer", "donutloader", "connectwise", "HijackLoader", "encrypted", "GuLoader", "mirai", "rev-base64-loader", "DarkCloud", "VIPKeylogger", "python", "stealer", "Emmenhtal", "lnk", "DynamicStealer", "sh", "screenconnect", "gafgyt", "geofenced", "HKG", "IND", "TUR", "apk", "jar", "AgentTesla", "BABADEDA", "phorpiex", "Metasploit", "Cobalt strike", "jpg-base64-loader", "Amadey", "SharkStealer", "blight", "botnet", "ddos", "iot botnet", "malware", "censys", "CobaltStrike", "booking", "ClickFix", "dcrat", "FakeCaptcha", "xml-opendir", "hajime", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 70, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 256, "domain": 15, "hostname": 10 }, "indicator_count": 281, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "336 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "captcha123.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "captcha123.com", "found": true, "verdict": "malicious", "url_count": 3, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://captcha123.com/lander/tradingview/3.vbs", "status": "offline", "threat": "malware_download", "date_added": "2025-05-31", "tags": [] }, { "url": "https://captcha123.com/lander/tradingview/1.ps1", "status": "offline", "threat": "malware_download", "date_added": "2025-05-30", "tags": [ "python", "stealer" ] }, { "url": "https://captcha123.com/lander/tradingview/pass.py", "status": "offline", "threat": "malware_download", "date_added": "2025-05-30", "tags": [ "python", "stealer" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780306905.003315 }